Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data

Domains/URLs

_msdcs.cktime.ooguy.com

067.cz

1421.client.96html.com

1421.cloud.96html.com

1421.support.96html.com

154-119-131-252-103-58-216-162-36.m.secshow.net

20656.hus1.ptps.tk

20656.hus3.ptps.tk

2-12-44-140-78-81-211-109-241.h.secshow.net

22852.careers.96html.com

22852.careers.trendmicro.96html.com

22852.trendmicro.96html.com

23175.careers.96html.com

23175.careers.trendmicro.96html.com

24280.hus1.ptps.tk

2637596418.softether.net

28394.careers.96html.com

28394.careers.trendmicro.96html.com

28394.trendmicro.96html.com

28733.careers.trendmicro.96html.com

28733.trendmicro.96html.com

30773.hus2.ptps.tk

30773.hus3.ptps.tk

35584.careers.96html.com

35584.careers.trendmicro.96html.com

35584.trendmicro.96html.com

39583.b.alitagotest.cf

3w.feeee.io

44673.careers.96html.com

44673.trendmicro.96html.com

47298.96html.com

47298.client.96html.com

47298.cloud.96html.com

47298.support.96html.com

50669.careers.trendmicro.96html.com

51640.careers.trendmicro.96html.com

51943.hus1.ptps.tk

51943.hus3.ptps.tk

54-2-32-236-208-2-40-107-38.h.secshow.net

60928.hus1.ptps.tk

66-37-178-96-110-2-40-107-38.h.secshow.net

74788.careers.96html.com

74788.trendmicro.96html.com

77692.careers.96html.com

77692.careers.trendmicro.96html.com

77692.trendmicro.96html.com

82262.careers.96html.com

82262.careers.trendmicro.96html.com

85005.careers.96html.com

85005.careers.trendmicro.96html.com

85005.trendmicro.96html.com

88783.hus1.ptps.tk

90174.careers.96html.com

90174.careers.trendmicro.96html.com

96976.careers.96html.com

96976.trendmicro.96html.com

96cee.com

96html.com

98aiblog.com

a.alitagotest.cf

a.studiocloud.xyz

admin.dellme.ml

alitagotest.cf

arforcex.com

asean.twimg.co.uk

az.studiocloud.xyz

b.alitagotest.cf

bailbonding.info

bbs.sunmoon.website

bj-hk.hmbcloud.net

bj-jp.hmbcloud.net

blog.98aiblog.com

bsnl.twimg.co.uk

careers.96html.com

careers.trendmicro.96html.com

cch.ooguy.com

check.96html.com

checkapi.tk

checkinfo.tk

chr0mail.com

cktime.ooguy.com

client.96html.com

cloud.96html.com

csrfproxy.studiocloud.xyz

dasxcyb.ga

dc-29465b27aa45.96html.com

dc-4fe9871cb224.96html.com

dc-582fc0f46da9.96html.com

dc-843d98722400.96html.com

dc-bb503834b7dc.96html.com

dc-c11a983d7f83.96html.com

dellme.ml

dns.studiocloud.xyz

dns361.tk

dsdsei.com

eck.giize.com

eg.twimg.co.uk

etechhosting.twimg.co.uk

fcchk.twimg.co.uk

feeee.io

findfindx.com

fukua.org

gate.sinica.edu.tw.checkapi.cf

googles.ddns.net

gz-hk.hmbcloud.net

h.secshow.net

h5.feeee.io

halloween.checkapi.cf

helpuself.ptps.tk

hgiga.96html.com

honey1314520.com

hook.studiocloud.xyz

hus1.ptps.tk

hus3.ptps.tk

hw1.ptps.tk

ica.96html.com

im.arforcex.com

imap.sunmoon.website

info.96html.com

integritytoch.com

iplc-hk.hmbcloud.com

javacheck.ooguy.com

javaupdate.giize.com

just.checkapi.cf

kk.dasxcyb.ga

leicc009.ga

live.studiocloud.xyz

ls.twimg.co.uk

m.secshow.net

ma.studiocloud.xyz

mail.bailbonding.info

mail.sunmoon.website

masaplus.club

microscan.me

mitt.96html.com

ms.studiocloud.xyz

msedge.store

mx.sunmoon.website

natcloudservice.com

nikoes.gq

np.twimg.co.uk

ns1.alitagotest.cf

ns1.honey1314520.com

ns1.nikoes.gq

ns2.nikoes.gq

one.hmbiplc-01.com

payment.feeee.io

pdc._msdcs.cktime.ooguy.com

ptps.tk

puc.checkapi.tk

purple76.com

pw.sexytube0.com

pw2.sexytube0.com

random.cktime.ooguy.com

s3crts.softether.net

scallpay.com

search.96html.com

secretr.feeee.io

secshow.net

senate.twimg.co.uk

server.feeee.io

sexytube0.com

shifuj.com

sh-jp.hmbcloud.net

shop.96html.com

shopify.feeee.io

smtp.sunmoon.website

streescans.com

studiocloud.xyz

sunmoon.website

supper.feeee.io

support.96html.com

szxcm-hkg01.iepl.node.cm

t.checkinfo.tk

teyan.microscan.me

tj.twimg.co.uk

traffic.96html.com

trendmicro.96html.com

trust.feeee

tsedws.com

txt.studiocloud.xyz

update.96html.com

upgrate.checkapi.cf

upl.natcloudservice.com

v3.streescans.com

vnpt.sexytube0.com

vpn21.arforcex.com

vpn328433596.softether.net

vpn614174689.softether.net

vpn677190427.softether.net

vpn718535264.softether.net

vpn823494147.softether.net

wanfang.accesscam.org

webdisk.bailbonding.info

webmail.studiocloud.xyz

well.96html.com

ws.studiocloud.xyz

wss.studiocloud.xyz

www.96html.com

www.alitagotest.cf

www.chr0mail.com

www.cktime.ooguy.com

www.dns361.tk

www.feeee.io

www.javacheck.ooguy.com

www.leicc009.ga

www.msedge.store

www.mx.sunmoon.website

www.purple76.com

www.smtp.sunmoon.website

www.sofeter.ml

www.studiocloud.xyz

www.sunmoon.website

www.www.smtp.sunmoon.website

www.www.sunmoon.website

xassxxdns.alitagotest.cf

ximmd.sexytube0.com

zerogravity1986.softether.net

96cee.com

asean.twimg.co.uk

bj-hk.hmbcloud.net

bj-jp.hmbcloud.net

blog.98aiblog.com

bsnl.twimg.co.uk

dns.studiocloud.xyz

eg.twimg.co.uk

etechhosting.twimg.co.uk

fcchk.twimg.co.uk

gz-hk.hmbcloud.net

iplc-hk.hmbcloud.com

javacheck.ooguy.com

javaupdate.giize.com

ls.twimg.co.uk

np.twimg.co.uk

one.hmbiplc-01.com

pw.sexytube0.com

senate.twimg.co.uk

sh-jp.hmbcloud.net

studiocloud.xyz

szxcm-hkg01.iepl.node.cm

tj.twimg.co.uk

ximmd.sexytube0.com

IP Address

1.34.140.5

2.58.242.74

5.188.34.134

5.188.230.69

8.219.119.5

14.1.98.160

14.128.33.8

14.1.98.223

27.154.215.126

27.154.105.36

27.149.115.78

27.149.79.35

31.232.221.35

36.112.10.102

36.112.188.119

36.112.186.135

36.112.206.121

36.249.156.117

36.249.156.122

36.249.156.159

36.249.156.178

36.249.156.205

36.249.156.206

36.249.156.220

36.249.156.226

36.112.200.35

36.249.156.51

36.112.198.68

36.249.156.69

36.112.10.99

39.72.220.221

42.73.98.232

45.123.189.19

45.32.140.182

45.32.232.146

45.63.123.142

45.63.116.190

45.131.69.197

45.76.169.12

45.77.195.169

45.32.61.246

45.77.231.209

45.76.37.168

45.63.59.121

45.77.11.47

45.32.84.223

45.63.62.217

45.63.48.36

45.76.43.37

45.76.66.19

45.76.243.67

45.63.17.9

45.77.28.77

45.76.194.89

45.76.37.85

45.63.95.62

45.63.94.71

45.77.86.70

49.93.136.14

49.93.184.194

59.120.144.153

59.124.120.178

59.120.167.25

59.125.128.54

59.120.58.176

60.250.199.112

60.250.146.19

60.251.155.19

60.248.152.204

59.120.82.67

60.184.242.224

60.251.205.37

60.220.43.193

60.251.58.145

60.248.1.64

60.251.201.8

60.248.88.151

60.248.110.97

60.249.239.86

61.220.112.137

60.220.84.41

61.247.165.27

60.220.84.63

61.220.35.15

61.221.55.4

61.222.245.73

61.219.118.99

61.216.74.97

64.176.38.35

65.20.97.251

66.42.103.188

66.42.42.109

66.42.40.189

66.42.36.236

66.42.60.242

66.42.77.138

77.111.226.5

78.141.221.241

78.141.238.97

84.17.57.40

89.187.163.216

95.179.189.106

95.179.235.135

95.179.186.251

98.159.37.4

103.107.198.117

103.16.231.220

103.16.231.254

103.233.253.197

103.25.254.210

103.149.200.44

103.179.45.203

103.73.160.232

103.77.211.193

103.106.230.88

103.172.80.35

104.238.149.146

104.238.182.153

104.238.152.209

103.51.145.98

103.73.162.99

104.156.231.98

106.53.181.231

106.122.171.92

108.61.181.104

108.61.177.81

110.42.10.148

110.85.170.125

111.203.153.245

110.74.172.80

111.55.138.141

111.55.137.40

111.203.153.95

112.5.168.102

112.5.168.104

112.5.145.154

112.5.143.161

112.5.168.138

112.5.168.151

112.5.168.160

112.54.132.162

112.5.168.187

112.5.168.218

112.5.168.231

112.5.168.234

112.5.168.238

112.51.26.151

112.66.108.16

112.5.168.29

112.51.44.102

112.51.44.142

112.51.44.143

112.51.44.188

112.51.44.189

112.51.44.20

112.51.44.206

112.51.44.217

112.51.44.234

112.5.168.65

112.51.44.37

112.80.50.138

112.51.44.57

112.5.168.93

113.76.136.171

114.246.237.111

114.255.70.18

114.255.70.20

114.255.70.30

114.246.93.103

114.246.94.102

114.35.122.83

114.246.94.154

114.246.92.58

114.246.92.71

117.133.51.176

117.61.244.135

117.56.214.246

117.132.198.70

117.92.127.132

117.130.201.90

118.163.217.199

118.163.197.241

118.163.31.226

118.163.104.67

118.163.142.80

118.163.3.76

119.116.159.217

119.13.79.145

120.233.10.212

120.36.251.100

120.36.248.104

120.42.128.165

120.36.250.103

120.36.254.100

120.36.248.109

120.36.253.106

120.36.255.105

120.36.251.110

120.36.251.11

120.36.249.114

120.36.251.114

120.36.254.112

120.36.249.121

120.36.249.122

120.36.254.119

120.36.254.120

120.36.249.127

120.36.251.130

120.36.255.127

120.36.252.13

120.36.250.133

120.36.250.134

120.36.250.135

120.36.254.131

120.36.254.135

120.36.251.141

120.36.250.142

120.41.125.225

120.36.253.148

120.36.250.152

120.36.252.151

120.36.253.152

120.36.254.151

120.36.255.153

120.36.252.157

120.37.162.246

120.36.252.166

120.36.249.172

120.36.253.169

120.36.252.175

120.36.254.175

120.36.251.179

120.36.253.178

120.36.252.18

120.36.252.181

120.36.248.185

120.36.253.180

120.36.255.179

120.36.253.186

120.36.253.187

120.36.250.19

120.36.251.19

120.36.251.190

120.36.255.189

120.41.244.15

120.36.254.192

120.36.249.197

120.36.248.200

120.36.253.195

120.36.251.2

120.36.251.20

120.36.255.196

120.36.251.202

120.36.254.202

120.36.250.207

120.36.250.210

120.36.249.213

120.36.251.213

120.36.253.212

120.36.251.215

120.36.252.215

120.36.255.214

120.36.250.221

120.36.255.22

120.36.251.230

120.36.255.228

120.36.253.23

120.36.253.231

120.36.251.234

120.36.248.237

120.36.253.232

120.36.253.233

120.36.249.238

120.36.251.237

120.36.255.233

120.36.255.237

120.36.249.245

120.36.252.242

120.36.255.24

120.36.249.248

120.36.250.247

120.36.253.247

120.36.253.248

120.36.251.25

120.36.251.254

120.36.249.28

120.36.251.3

120.36.251.30

120.36.254.3

120.36.254.32

120.36.249.33

120.36.250.4

120.36.250.43

120.36.249.47

120.36.248.48

120.36.250.48

120.36.249.52

120.36.250.53

120.36.249.54

120.36.251.54

120.36.249.55

120.36.251.56

120.36.248.57

120.36.250.58

120.36.250.6

120.36.253.6

120.36.254.63

120.36.250.65

120.36.251.65

120.36.250.67

120.36.252.69

120.36.248.73

120.36.255.74

120.36.250.76

120.41.222.74

120.36.248.80

120.36.251.80

120.36.251.84

120.36.252.90

120.36.249.91

120.36.251.91

120.36.252.91

120.36.254.92

120.36.254.94

120.36.248.97

120.36.251.97

120.36.249.98

120.36.252.98

121.207.60.123

122.116.33.118

122.232.149.231

122.201.241.230

122.116.159.52

122.116.102.93

123.121.157.240

123.51.237.194

123.252.121.7

123.252.122.7

123.12.90.227

123.60.61.104

124.126.158.130

124.126.139.199

124.127.17.171

124.127.220.223

124.150.135.3

123.51.223.96

124.64.22.13

124.126.141.74

124.127.78.22

124.127.72.52

125.227.147.106

125.227.140.168

125.227.1.220

125.227.196.157

125.227.219.145

125.228.239.13

125.227.218.2

124.64.23.80

125.229.172.48

125.227.136.60

137.220.34.137

137.220.39.222

137.220.43.47

137.220.36.87

138.199.62.148

139.180.137.219

139.180.217.19

139.180.158.51

139.84.174.129

140.82.27.163

140.82.50.151

141.164.41.128

140.82.48.6

141.164.55.227

141.164.56.93

144.202.26.205

144.34.171.162

144.202.33.164

144.202.62.109

144.202.91.107

144.202.94.216

144.202.98.41

147.139.133.246

149.28.132.137

149.28.132.161

149.28.201.146

149.28.188.184

149.248.34.100

149.28.149.29

149.28.252.19

149.248.38.179

149.248.39.202

149.248.44.191

149.248.51.22

149.28.72.106

155.138.155.170

155.138.136.190

155.138.151.225

155.138.133.56

156.146.45.152

156.146.45.194

158.247.197.28

159.138.152.61

162.14.178.86

167.172.33.16

167.179.87.215

167.179.97.121

171.120.88.137

178.62.208.162

180.122.149.177

182.34.19.234

183.240.139.216

183.253.28.104

183.253.29.110

183.253.28.121

183.250.213.20

183.253.29.189

183.250.213.55

183.253.29.66

183.253.28.67

183.250.213.80

183.250.213.83

183.166.90.97

185.216.118.71

185.135.73.192

185.213.82.239

185.213.82.243

185.213.82.55

185.213.82.65

190.92.241.15

191.232.188.144

193.42.24.68

193.42.25.73

198.13.38.211

202.182.109.151

202.101.145.22

202.182.106.31

202.39.151.239

202.99.19.250

202.99.19.254

203.74.126.20

203.69.36.122

207.246.118.144

207.246.117.149

207.246.114.173

207.148.68.131

207.148.122.69

207.148.67.146

207.246.108.64

207.246.127.64

207.148.73.238

207.148.92.220

207.148.4.96

208.72.154.55

210.242.152.155

210.242.38.241

210.243.225.41

210.66.220.39

210.242.76.32

210.71.166.50

211.20.144.116

211.20.104.187

211.21.19.11

211.22.143.228

211.20.115.60

211.20.154.60

211.20.100.78

211.20.100.79

211.99.103.102

211.21.61.46

211.75.185.37

211.99.103.243

212.107.28.16

212.107.28.22

212.107.28.23

211.78.84.17

211.20.91.77

211.99.100.90

211.99.100.91

211.99.98.197

216.128.149.106

216.128.128.238

218.26.159.254

218.5.173.137

218.5.157.171

218.66.163.188

219.143.179.250

220.128.108.164

220.130.153.127

220.130.176.23

220.128.125.3

220.130.254.251

219.92.229.53

220.162.9.150

220.250.44.62

221.218.143.112

221.218.136.12

221.218.138.123

221.218.143.122

221.218.143.184

221.218.136.192

221.216.116.238

221.218.137.229

221.218.139.248

221.216.208.188

221.218.142.26

221.218.141.96

222.92.153.125

223.104.40.128

223.104.41.13

223.104.40.142

223.104.40.204

223.27.34.132

223.104.55.183

223.104.39.82

Hash

48ca18a25424a0f52276290b619a7a83

38f5ff8169423e2c756848c02e8cac3b

d61326c4e6d24aa9b67e2b7a3ef7cedf

f8de2e99dc7523d2c83d1a48e844c5ff

5b5a2c7fa705d8b1eb04da5db900b0d7

655cd134976d3e80c521708aa8be418b

dae8f50ea44225fae3ba1f160b42bfdc

fdece34bc084f1e252aeae274650eb8d

596b990b0b389d906a8f4384837c1878

a73eca669fe80628dbbd2c7d9bb14c8f

be121e707f817aa9392c55af1e7ec2aa

7ce68f0dd85355ba2897a68521167e56

f82694de2f19e1bff333c27bb7eb7a56

1933c314041415939331fce183939547

8829f6f1cc5fc0aab2f6e71bfd7dc53d

cf903e4a1629aa0582fd0363b5786676

f01a9a2d1e31332ed36c1a4d2839f412

ef713447f18f5b7ee16af4ac37ec4133

8dcc4f9ccc6b6adf7eeeb3f51c95afad

b04375cca637f0702bf27feaff22a92d

bcacc7ca999980d26c186ef791242fb5

1b8e29b6b7972fb124425aaa257f8f6d

4f61b9ab907f351bb40b37b10f4974d0

6d57c42dee8bd7789969e2dd28671162

776807750280daad05348f931a33e4ef

a973c0ab904c1b74655a906b99b76850

f62cbbbdf35c7790909c26c7c5fbce05

a05cdf6afcbb107961307f59cbab5e4f

7d5a182f70bed0e4fa2f8615aba070de

1bcaef76b2063f1b80b0fa0d277ec9c5

4d33bfb75e27fefaa72526899604d557

fc6e8ca41cf4f6100177352660e520b4

72c6af6a4be99e31c4a7a0aa4f01750792788e7f6f9749243a9f2c47c14a708f

456586ababa08f70216c4459f4d6375676166ebfddd98a33b447ceb5099e8dc5

2f5c406eb64ad8902c8e30610d43fd3efc05a14cdb8fb158818953eaf3dc6a81

5782ff2c835c88cc1ee521d2e8c523cfad73db3f9a29c93b40c4223f0338ade9

0e6fecb2d369b0eae63731616a3daada52036634885ab1b85b115af6bc5bcb86

36f3b7645609ef40444dbc68f01d26c543d67689eda4937272ea5cfa4df1b522

670fa10a2ddde21fd594c4fef86b554d864089ed2de7153b472e921c623403ae

645f6f2667af01a94d04a9d7a71916a13d9426835d636b4ceee2e25ccb34e525

4d488f21269b18e37aaca93ac2a61707c9b611e506cdb3b287277746e94636b5

a14844e982f172d0f23910558c3f390a9d4c45dc32db825c2af7cf0ed8631db2

add7dd142e4f7e2873bc8f7b7fb6308063608e0b49a773dea93abad4047f1489

e7e727458f573dded05537baddac2867d2801db1c3c74410398d063dfd6f6575

8e1b56ef51ba70aa4c4cfd4430820f20875b354588d5d723ba4d3940ea6c924b

46e59172c40c95d83c3a6f24f801fc2265653c8b575b66a726463e2a4eebd7f2

752b14c6e6936991d51fcd5ebf40d303e657c2372893604f96044848ad9a5f24

7b9efc7ef8957411cdd22582ce4bfb3a5f76d9c91cdb7e36bf85c9785a2480e9

c9d5dc956841e000bfd8762e2f0b48b66c79b79500e894b4efa7fb9ba17e4e9e

2fbcb1995c458e5affd5fb8f1f979a08ddce21714a2e413aa3d5dc44f9f245fe

33790218d5871af646feef5be29e0596d4703a45ce675c1eb2ca00140b3a1bde

c7f86a4623db5c90273cea041d43207849c5c6b0060c370b2095f13871b1366d

2ecb51d7fa3bc3fa7ad7df64c6d0cd1f4ff2b37ed6839d3cff529fb08af49fb0

efb0437e6a6a0f07169952f1a8b734299ec9a8b1faadbed811fe017f2cf54976

8b869a5edaff74ff18bca3658a519a19771e66d00ff7849af7a142dd6fc8da85

804a53be802378a8ec4c94602fd3d6584e0d472d83148e8a42c731950fec415d

c4503db6ece93eddf4511e787607cb14606a1df9f526f1e39992497119437cec

b1552703ff0035f197c22cdb3a514bb6aa45ec98de3ef5409faab0978f18c35e

8a592e22c51311d482272ec5aba0103c9cd0cfd78e5b5ba75dfa8f1c56926672

86f1cfa6a2e0a8cb6fc1fbee28472308e6467932f8658a6a4885e29ed8c34a67

e93244080a749b521f63476343ce3c81cc8c1b672fa0d9e67359aee37544c784

9dc85f9569a15eaf51c7d34254767ea30dd67b2178cec4cc7125288b9544fe00

644decbc6ce8c52382f4755fa6fc2cb4d89a0e7ec0e574c11b398a6f2eed04b1

67db57a1f957031b78f29aa91e2e87780eae3835290259eff846d8f14afb794b

Detection Query 1 :

domainname like "cktime.ooguy.com" or url like "cktime.ooguy.com" or siteurl like "cktime.ooguy.com" or domainname like "067.cz" or url like "067.cz" or siteurl like "067.cz" or domainname like "1421.client.96html.com" or url like "1421.client.96html.com" or siteurl like "1421.client.96html.com" or domainname like "1421.cloud.96html.com" or url like "1421.cloud.96html.com" or siteurl like "1421.cloud.96html.com" or domainname like "1421.support.96html.com" or url like "1421.support.96html.com" or siteurl like "1421.support.96html.com" or domainname like "154-119-131-252-103-58-216-162-36.m.secshow.net" or url like "154-119-131-252-103-58-216-162-36.m.secshow.net" or siteurl like "154-119-131-252-103-58-216-162-36.m.secshow.net" or domainname like "20656.hus1.ptps.tk" or url like "20656.hus1.ptps.tk" or siteurl like "20656.hus1.ptps.tk" or domainname like "20656.hus3.ptps.tk" or url like "20656.hus3.ptps.tk" or siteurl like "20656.hus3.ptps.tk" or domainname like "2-12-44-140-78-81-211-109-241.h.secshow.net" or url like "2-12-44-140-78-81-211-109-241.h.secshow.net" or siteurl like "2-12-44-140-78-81-211-109-241.h.secshow.net" or domainname like "22852.careers.96html.com" or url like "22852.careers.96html.com" or siteurl like "22852.careers.96html.com" or domainname like "22852.careers.trendmicro.96html.com" or url like "22852.careers.trendmicro.96html.com" or siteurl like "22852.careers.trendmicro.96html.com" or domainname like "22852.trendmicro.96html.com" or url like "22852.trendmicro.96html.com" or siteurl like "22852.trendmicro.96html.com" or domainname like "23175.careers.96html.com" or url like "23175.careers.96html.com" or siteurl like "23175.careers.96html.com" or domainname like "23175.careers.trendmicro.96html.com" or url like "23175.careers.trendmicro.96html.com" or siteurl like "23175.careers.trendmicro.96html.com" or domainname like "24280.hus1.ptps.tk" or url like "24280.hus1.ptps.tk" or siteurl like "24280.hus1.ptps.tk" or domainname like "2637596418.softether.net" or url like "2637596418.softether.net" or siteurl like "2637596418.softether.net" or domainname like "28394.careers.96html.com" or url like "28394.careers.96html.com" or siteurl like "28394.careers.96html.com" or domainname like "28394.careers.trendmicro.96html.com" or url like "28394.careers.trendmicro.96html.com" or siteurl like "28394.careers.trendmicro.96html.com" or domainname like "28394.trendmicro.96html.com" or url like "28394.trendmicro.96html.com" or siteurl like "28394.trendmicro.96html.com" or domainname like "28733.careers.trendmicro.96html.com" or url like "28733.careers.trendmicro.96html.com" or siteurl like "28733.careers.trendmicro.96html.com" or domainname like "28733.trendmicro.96html.com" or url like "28733.trendmicro.96html.com" or siteurl like "28733.trendmicro.96html.com" or domainname like "30773.hus2.ptps.tk" or url like "30773.hus2.ptps.tk" or siteurl like "30773.hus2.ptps.tk" or domainname like "30773.hus3.ptps.tk" or url like "30773.hus3.ptps.tk" or siteurl like "30773.hus3.ptps.tk" or domainname like "35584.careers.96html.com" or url like "35584.careers.96html.com" or siteurl like "35584.careers.96html.com" or domainname like "35584.careers.trendmicro.96html.com" or url like "35584.careers.trendmicro.96html.com" or siteurl like "35584.careers.trendmicro.96html.com" or domainname like "35584.trendmicro.96html.com" or url like "35584.trendmicro.96html.com" or siteurl like "35584.trendmicro.96html.com" or domainname like "39583.b.alitagotest.cf" or url like "39583.b.alitagotest.cf" or siteurl like "39583.b.alitagotest.cf" or domainname like "3w.feeee.io" or url like "3w.feeee.io" or siteurl like "3w.feeee.io" or domainname like "44673.careers.96html.com" or url like "44673.careers.96html.com" or siteurl like "44673.careers.96html.com" or domainname like "44673.trendmicro.96html.com" or url like "44673.trendmicro.96html.com" or siteurl like "44673.trendmicro.96html.com" or domainname like "47298.96html.com" or url like "47298.96html.com" or siteurl like "47298.96html.com" or domainname like "47298.client.96html.com" or url like "47298.client.96html.com" or siteurl like "47298.client.96html.com" or domainname like "47298.cloud.96html.com" or url like "47298.cloud.96html.com" or siteurl like "47298.cloud.96html.com" or domainname like "47298.support.96html.com" or url like "47298.support.96html.com" or siteurl like "47298.support.96html.com" or domainname like "50669.careers.trendmicro.96html.com" or url like "50669.careers.trendmicro.96html.com" or siteurl like "50669.careers.trendmicro.96html.com" or domainname like "51640.careers.trendmicro.96html.com" or url like "51640.careers.trendmicro.96html.com" or siteurl like "51640.careers.trendmicro.96html.com" or domainname like "51943.hus1.ptps.tk" or url like "51943.hus1.ptps.tk" or siteurl like "51943.hus1.ptps.tk" or domainname like "51943.hus3.ptps.tk" or url like "51943.hus3.ptps.tk" or siteurl like "51943.hus3.ptps.tk" or domainname like "54-2-32-236-208-2-40-107-38.h.secshow.net" or url like "54-2-32-236-208-2-40-107-38.h.secshow.net" or siteurl like "54-2-32-236-208-2-40-107-38.h.secshow.net" or domainname like "60928.hus1.ptps.tk" or url like "60928.hus1.ptps.tk" or siteurl like "60928.hus1.ptps.tk" or domainname like "66-37-178-96-110-2-40-107-38.h.secshow.net" or url like "66-37-178-96-110-2-40-107-38.h.secshow.net" or siteurl like "66-37-178-96-110-2-40-107-38.h.secshow.net" or domainname like "74788.careers.96html.com" or url like "74788.careers.96html.com" or siteurl like "74788.careers.96html.com" or domainname like "74788.trendmicro.96html.com" or url like "74788.trendmicro.96html.com" or siteurl like "74788.trendmicro.96html.com" or domainname like "77692.careers.96html.com" or url like "77692.careers.96html.com" or siteurl like "77692.careers.96html.com" or domainname like "77692.careers.trendmicro.96html.com" or url like "77692.careers.trendmicro.96html.com" or siteurl like "77692.careers.trendmicro.96html.com" or domainname like "77692.trendmicro.96html.com" or url like "77692.trendmicro.96html.com" or siteurl like "77692.trendmicro.96html.com" or domainname like "82262.careers.96html.com" or url like "82262.careers.96html.com" or siteurl like "82262.careers.96html.com" or domainname like "82262.careers.trendmicro.96html.com" or url like "82262.careers.trendmicro.96html.com" or siteurl like "82262.careers.trendmicro.96html.com" or domainname like "85005.careers.96html.com" or url like "85005.careers.96html.com" or siteurl like "85005.careers.96html.com" or domainname like "85005.careers.trendmicro.96html.com" or url like "85005.careers.trendmicro.96html.com" or siteurl like "85005.careers.trendmicro.96html.com" or domainname like "85005.trendmicro.96html.com" or url like "85005.trendmicro.96html.com" or siteurl like "85005.trendmicro.96html.com" or domainname like "88783.hus1.ptps.tk" or url like "88783.hus1.ptps.tk" or siteurl like "88783.hus1.ptps.tk" or domainname like "90174.careers.96html.com" or url like "90174.careers.96html.com" or siteurl like "90174.careers.96html.com" or domainname like "90174.careers.trendmicro.96html.com" or url like "90174.careers.trendmicro.96html.com" or siteurl like "90174.careers.trendmicro.96html.com" or domainname like "96976.careers.96html.com" or url like "96976.careers.96html.com" or siteurl like "96976.careers.96html.com" or domainname like "96976.trendmicro.96html.com" or url like "96976.trendmicro.96html.com" or siteurl like "96976.trendmicro.96html.com" or domainname like "96cee.com" or url like "96cee.com" or siteurl like "96cee.com" or domainname like "96html.com" or url like "96html.com" or siteurl like "96html.com" or domainname like "98aiblog.com" or url like "98aiblog.com" or siteurl like "98aiblog.com" or domainname like "a.alitagotest.cf" or url like "a.alitagotest.cf" or siteurl like "a.alitagotest.cf"

Detection Query 2 :

domainname like "a.studiocloud.xyz" or url like "a.studiocloud.xyz" or siteurl like "a.studiocloud.xyz" or domainname like "admin.dellme.ml" or url like "admin.dellme.ml" or siteurl like "admin.dellme.ml" or domainname like "alitagotest.cf" or url like "alitagotest.cf" or siteurl like "alitagotest.cf" or domainname like "arforcex.com" or url like "arforcex.com" or siteurl like "arforcex.com" or domainname like "asean.twimg.co.uk" or url like "asean.twimg.co.uk" or siteurl like "asean.twimg.co.uk" or domainname like "az.studiocloud.xyz" or url like "az.studiocloud.xyz" or siteurl like "az.studiocloud.xyz" or domainname like "b.alitagotest.cf" or url like "b.alitagotest.cf" or siteurl like "b.alitagotest.cf" or domainname like "bailbonding.info" or url like "bailbonding.info" or siteurl like "bailbonding.info" or domainname like "bbs.sunmoon.website" or url like "bbs.sunmoon.website" or siteurl like "bbs.sunmoon.website" or domainname like "bj-hk.hmbcloud.net" or url like "bj-hk.hmbcloud.net" or siteurl like "bj-hk.hmbcloud.net" or domainname like "bj-jp.hmbcloud.net" or url like "bj-jp.hmbcloud.net" or siteurl like "bj-jp.hmbcloud.net" or domainname like "blog.98aiblog.com" or url like "blog.98aiblog.com" or siteurl like "blog.98aiblog.com" or domainname like "bsnl.twimg.co.uk" or url like "bsnl.twimg.co.uk" or siteurl like "bsnl.twimg.co.uk" or domainname like "careers.96html.com" or url like "careers.96html.com" or siteurl like "careers.96html.com" or domainname like "careers.trendmicro.96html.com" or url like "careers.trendmicro.96html.com" or siteurl like "careers.trendmicro.96html.com" or domainname like "cch.ooguy.com" or url like "cch.ooguy.com" or siteurl like "cch.ooguy.com" or domainname like "check.96html.com" or url like "check.96html.com" or siteurl like "check.96html.com" or domainname like "checkapi.tk" or url like "checkapi.tk" or siteurl like "checkapi.tk" or domainname like "checkinfo.tk" or url like "checkinfo.tk" or siteurl like "checkinfo.tk" or domainname like "chr0mail.com" or url like "chr0mail.com" or siteurl like "chr0mail.com" or domainname like "client.96html.com" or url like "client.96html.com" or siteurl like "client.96html.com" or domainname like "cloud.96html.com" or url like "cloud.96html.com" or siteurl like "cloud.96html.com" or domainname like "csrfproxy.studiocloud.xyz" or url like "csrfproxy.studiocloud.xyz" or siteurl like "csrfproxy.studiocloud.xyz" or domainname like "dasxcyb.ga" or url like "dasxcyb.ga" or siteurl like "dasxcyb.ga" or domainname like "dc-29465b27aa45.96html.com" or url like "dc-29465b27aa45.96html.com" or siteurl like "dc-29465b27aa45.96html.com" or domainname like "dc-4fe9871cb224.96html.com" or url like "dc-4fe9871cb224.96html.com" or siteurl like "dc-4fe9871cb224.96html.com" or domainname like "dc-582fc0f46da9.96html.com" or url like "dc-582fc0f46da9.96html.com" or siteurl like "dc-582fc0f46da9.96html.com" or domainname like "dc-843d98722400.96html.com" or url like "dc-843d98722400.96html.com" or siteurl like "dc-843d98722400.96html.com" or domainname like "dc-bb503834b7dc.96html.com" or url like "dc-bb503834b7dc.96html.com" or siteurl like "dc-bb503834b7dc.96html.com" or domainname like "dc-c11a983d7f83.96html.com" or url like "dc-c11a983d7f83.96html.com" or siteurl like "dc-c11a983d7f83.96html.com" or domainname like "dellme.ml" or url like "dellme.ml" or siteurl like "dellme.ml" or domainname like "dns.studiocloud.xyz" or url like "dns.studiocloud.xyz" or siteurl like "dns.studiocloud.xyz" or domainname like "dns361.tk" or url like "dns361.tk" or siteurl like "dns361.tk" or domainname like "dsdsei.com" or url like "dsdsei.com" or siteurl like "dsdsei.com" or domainname like "eck.giize.com" or url like "eck.giize.com" or siteurl like "eck.giize.com" or domainname like "eg.twimg.co.uk" or url like "eg.twimg.co.uk" or siteurl like "eg.twimg.co.uk" or domainname like "etechhosting.twimg.co.uk" or url like "etechhosting.twimg.co.uk" or siteurl like "etechhosting.twimg.co.uk" or domainname like "fcchk.twimg.co.uk" or url like "fcchk.twimg.co.uk" or siteurl like "fcchk.twimg.co.uk" or domainname like "feeee.io" or url like "feeee.io" or siteurl like "feeee.io" or domainname like "findfindx.com" or url like "findfindx.com" or siteurl like "findfindx.com" or domainname like "fukua.org" or url like "fukua.org" or siteurl like "fukua.org" or domainname like "gate.sinica.edu.tw.checkapi.cf" or url like "gate.sinica.edu.tw.checkapi.cf" or siteurl like "gate.sinica.edu.tw.checkapi.cf" or domainname like "googles.ddns.net" or url like "googles.ddns.net" or siteurl like "googles.ddns.net" or domainname like "gz-hk.hmbcloud.net" or url like "gz-hk.hmbcloud.net" or siteurl like "gz-hk.hmbcloud.net" or domainname like "h.secshow.net" or url like "h.secshow.net" or siteurl like "h.secshow.net" or domainname like "h5.feeee.io" or url like "h5.feeee.io" or siteurl like "h5.feeee.io" or domainname like "halloween.checkapi.cf" or url like "halloween.checkapi.cf" or siteurl like "halloween.checkapi.cf" or domainname like "helpuself.ptps.tk" or url like "helpuself.ptps.tk" or siteurl like "helpuself.ptps.tk" or domainname like "hgiga.96html.com" or url like "hgiga.96html.com" or siteurl like "hgiga.96html.com" or domainname like "honey1314520.com" or url like "honey1314520.com" or siteurl like "honey1314520.com" or domainname like "hook.studiocloud.xyz" or url like "hook.studiocloud.xyz" or siteurl like "hook.studiocloud.xyz" or domainname like "hus1.ptps.tk" or url like "hus1.ptps.tk" or siteurl like "hus1.ptps.tk" or domainname like "hus3.ptps.tk" or url like "hus3.ptps.tk" or siteurl like "hus3.ptps.tk" or domainname like "hw1.ptps.tk" or url like "hw1.ptps.tk" or siteurl like "hw1.ptps.tk" or domainname like "ica.96html.com" or url like "ica.96html.com" or siteurl like "ica.96html.com" or domainname like "im.arforcex.com" or url like "im.arforcex.com" or siteurl like "im.arforcex.com" or domainname like "imap.sunmoon.website" or url like "imap.sunmoon.website" or siteurl like "imap.sunmoon.website" or domainname like "info.96html.com" or url like "info.96html.com" or siteurl like "info.96html.com" or domainname like "integritytoch.com" or url like "integritytoch.com" or siteurl like "integritytoch.com" or domainname like "iplc-hk.hmbcloud.com" or url like "iplc-hk.hmbcloud.com" or siteurl like "iplc-hk.hmbcloud.com" or domainname like "javacheck.ooguy.com" or url like "javacheck.ooguy.com" or siteurl like "javacheck.ooguy.com" or domainname like "javaupdate.giize.com" or url like "javaupdate.giize.com" or siteurl like "javaupdate.giize.com" or domainname like "just.checkapi.cf" or url like "just.checkapi.cf" or siteurl like "just.checkapi.cf" or domainname like "kk.dasxcyb.ga" or url like "kk.dasxcyb.ga" or siteurl like "kk.dasxcyb.ga" or domainname like "leicc009.ga" or url like "leicc009.ga" or siteurl like "leicc009.ga" or domainname like "live.studiocloud.xyz" or url like "live.studiocloud.xyz" or siteurl like "live.studiocloud.xyz" or domainname like "ls.twimg.co.uk" or url like "ls.twimg.co.uk" or siteurl like "ls.twimg.co.uk" or domainname like "m.secshow.net" or url like "m.secshow.net" or siteurl like "m.secshow.net" or domainname like "ma.studiocloud.xyz" or url like "ma.studiocloud.xyz" or siteurl like "ma.studiocloud.xyz" or domainname like "mail.bailbonding.info" or url like "mail.bailbonding.info" or siteurl like "mail.bailbonding.info" or domainname like "mail.sunmoon.website" or url like "mail.sunmoon.website" or siteurl like "mail.sunmoon.website" or domainname like "masaplus.club" or url like "masaplus.club" or siteurl like "masaplus.club" or domainname like "microscan.me" or url like "microscan.me" or siteurl like "microscan.me" or domainname like "mitt.96html.com" or url like "mitt.96html.com" or siteurl like "mitt.96html.com" or domainname like "ms.studiocloud.xyz" or url like "ms.studiocloud.xyz" or siteurl like "ms.studiocloud.xyz" or domainname like "msedge.store" or url like "msedge.store" or siteurl like "msedge.store" or domainname like "mx.sunmoon.website" or url like "mx.sunmoon.website" or siteurl like "mx.sunmoon.website" or domainname like "natcloudservice.com" or url like "natcloudservice.com" or siteurl like "natcloudservice.com" or domainname like "nikoes.gq" or url like "nikoes.gq" or siteurl like "nikoes.gq" or domainname like "np.twimg.co.uk" or url like "np.twimg.co.uk" or siteurl like "np.twimg.co.uk" or domainname like "ns1.alitagotest.cf" or url like "ns1.alitagotest.cf" or siteurl like "ns1.alitagotest.cf"

Detection Query 3 :

domainname like "ns1.honey1314520.com" or url like "ns1.honey1314520.com" or siteurl like "ns1.honey1314520.com" or domainname like "ns1.nikoes.gq" or url like "ns1.nikoes.gq" or siteurl like "ns1.nikoes.gq" or domainname like "ns2.nikoes.gq" or url like "ns2.nikoes.gq" or siteurl like "ns2.nikoes.gq" or domainname like "one.hmbiplc-01.com" or url like "one.hmbiplc-01.com" or siteurl like "one.hmbiplc-01.com" or domainname like "payment.feeee.io" or url like "payment.feeee.io" or siteurl like "payment.feeee.io" or domainname like "ptps.tk" or url like "ptps.tk" or siteurl like "ptps.tk" or domainname like "puc.checkapi.tk" or url like "puc.checkapi.tk" or siteurl like "puc.checkapi.tk" or domainname like "purple76.com" or url like "purple76.com" or siteurl like "purple76.com" or domainname like "pw.sexytube0.com" or url like "pw.sexytube0.com" or siteurl like "pw.sexytube0.com" or domainname like "pw2.sexytube0.com" or url like "pw2.sexytube0.com" or siteurl like "pw2.sexytube0.com" or domainname like "random.cktime.ooguy.com" or url like "random.cktime.ooguy.com" or siteurl like "random.cktime.ooguy.com" or domainname like "s3crts.softether.net" or url like "s3crts.softether.net" or siteurl like "s3crts.softether.net" or domainname like "scallpay.com" or url like "scallpay.com" or siteurl like "scallpay.com" or domainname like "search.96html.com" or url like "search.96html.com" or siteurl like "search.96html.com" or domainname like "secretr.feeee.io" or url like "secretr.feeee.io" or siteurl like "secretr.feeee.io" or domainname like "secshow.net" or url like "secshow.net" or siteurl like "secshow.net" or domainname like "senate.twimg.co.uk" or url like "senate.twimg.co.uk" or siteurl like "senate.twimg.co.uk" or domainname like "server.feeee.io" or url like "server.feeee.io" or siteurl like "server.feeee.io" or domainname like "sexytube0.com" or url like "sexytube0.com" or siteurl like "sexytube0.com" or domainname like "shifuj.com" or url like "shifuj.com" or siteurl like "shifuj.com" or domainname like "sh-jp.hmbcloud.net" or url like "sh-jp.hmbcloud.net" or siteurl like "sh-jp.hmbcloud.net" or domainname like "shop.96html.com" or url like "shop.96html.com" or siteurl like "shop.96html.com" or domainname like "shopify.feeee.io" or url like "shopify.feeee.io" or siteurl like "shopify.feeee.io" or domainname like "smtp.sunmoon.website" or url like "smtp.sunmoon.website" or siteurl like "smtp.sunmoon.website" or domainname like "streescans.com" or url like "streescans.com" or siteurl like "streescans.com" or domainname like "studiocloud.xyz" or url like "studiocloud.xyz" or siteurl like "studiocloud.xyz" or domainname like "sunmoon.website" or url like "sunmoon.website" or siteurl like "sunmoon.website" or domainname like "supper.feeee.io" or url like "supper.feeee.io" or siteurl like "supper.feeee.io" or domainname like "support.96html.com" or url like "support.96html.com" or siteurl like "support.96html.com" or domainname like "szxcm-hkg01.iepl.node.cm" or url like "szxcm-hkg01.iepl.node.cm" or siteurl like "szxcm-hkg01.iepl.node.cm" or domainname like "t.checkinfo.tk" or url like "t.checkinfo.tk" or siteurl like "t.checkinfo.tk" or domainname like "teyan.microscan.me" or url like "teyan.microscan.me" or siteurl like "teyan.microscan.me" or domainname like "tj.twimg.co.uk" or url like "tj.twimg.co.uk" or siteurl like "tj.twimg.co.uk" or domainname like "traffic.96html.com" or url like "traffic.96html.com" or siteurl like "traffic.96html.com" or domainname like "trendmicro.96html.com" or url like "trendmicro.96html.com" or siteurl like "trendmicro.96html.com" or domainname like "trust.feeee" or url like "trust.feeee" or siteurl like "trust.feeee" or domainname like "tsedws.com" or url like "tsedws.com" or siteurl like "tsedws.com" or domainname like "txt.studiocloud.xyz" or url like "txt.studiocloud.xyz" or siteurl like "txt.studiocloud.xyz" or domainname like "update.96html.com" or url like "update.96html.com" or siteurl like "update.96html.com" or domainname like "upgrate.checkapi.cf" or url like "upgrate.checkapi.cf" or siteurl like "upgrate.checkapi.cf" or domainname like "upl.natcloudservice.com" or url like "upl.natcloudservice.com" or siteurl like "upl.natcloudservice.com" or domainname like "v3.streescans.com" or url like "v3.streescans.com" or siteurl like "v3.streescans.com" or domainname like "vnpt.sexytube0.com" or url like "vnpt.sexytube0.com" or siteurl like "vnpt.sexytube0.com" or domainname like "vpn21.arforcex.com" or url like "vpn21.arforcex.com" or siteurl like "vpn21.arforcex.com" or domainname like "vpn328433596.softether.net" or url like "vpn328433596.softether.net" or siteurl like "vpn328433596.softether.net" or domainname like "vpn614174689.softether.net" or url like "vpn614174689.softether.net" or siteurl like "vpn614174689.softether.net" or domainname like "vpn677190427.softether.net" or url like "vpn677190427.softether.net" or siteurl like "vpn677190427.softether.net" or domainname like "vpn718535264.softether.net" or url like "vpn718535264.softether.net" or siteurl like "vpn718535264.softether.net" or domainname like "vpn823494147.softether.net" or url like "vpn823494147.softether.net" or siteurl like "vpn823494147.softether.net" or domainname like "wanfang.accesscam.org" or url like "wanfang.accesscam.org" or siteurl like "wanfang.accesscam.org" or domainname like "webdisk.bailbonding.info" or url like "webdisk.bailbonding.info" or siteurl like "webdisk.bailbonding.info" or domainname like "webmail.studiocloud.xyz" or url like "webmail.studiocloud.xyz" or siteurl like "webmail.studiocloud.xyz" or domainname like "well.96html.com" or url like "well.96html.com" or siteurl like "well.96html.com" or domainname like "ws.studiocloud.xyz" or url like "ws.studiocloud.xyz" or siteurl like "ws.studiocloud.xyz" or domainname like "wss.studiocloud.xyz" or url like "wss.studiocloud.xyz" or siteurl like "wss.studiocloud.xyz" or domainname like "www.96html.com" or url like "www.96html.com" or siteurl like "www.96html.com" or domainname like "www.alitagotest.cf" or url like "www.alitagotest.cf" or siteurl like "www.alitagotest.cf" or domainname like "www.chr0mail.com" or url like "www.chr0mail.com" or siteurl like "www.chr0mail.com" or domainname like "www.cktime.ooguy.com" or url like "www.cktime.ooguy.com" or siteurl like "www.cktime.ooguy.com" or domainname like "www.dns361.tk" or url like "www.dns361.tk" or siteurl like "www.dns361.tk" or domainname like "www.feeee.io" or url like "www.feeee.io" or siteurl like "www.feeee.io" or domainname like "www.javacheck.ooguy.com" or url like "www.javacheck.ooguy.com" or siteurl like "www.javacheck.ooguy.com" or domainname like "www.leicc009.ga" or url like "www.leicc009.ga" or siteurl like "www.leicc009.ga" or domainname like "www.msedge.store" or url like "www.msedge.store" or siteurl like "www.msedge.store" or domainname like "www.mx.sunmoon.website" or url like "www.mx.sunmoon.website" or siteurl like "www.mx.sunmoon.website" or domainname like "www.purple76.com" or url like "www.purple76.com" or siteurl like "www.purple76.com" or domainname like "www.smtp.sunmoon.website" or url like "www.smtp.sunmoon.website" or siteurl like "www.smtp.sunmoon.website" or domainname like "www.sofeter.ml" or url like "www.sofeter.ml" or siteurl like "www.sofeter.ml" or domainname like "www.studiocloud.xyz" or url like "www.studiocloud.xyz" or siteurl like "www.studiocloud.xyz" or domainname like "www.sunmoon.website" or url like "www.sunmoon.website" or siteurl like "www.sunmoon.website" or domainname like "www.www.smtp.sunmoon.website" or url like "www.www.smtp.sunmoon.website" or siteurl like "www.www.smtp.sunmoon.website" or domainname like "www.www.sunmoon.website" or url like "www.www.sunmoon.website" or siteurl like "www.www.sunmoon.website" or domainname like "xassxxdns.alitagotest.cf" or url like "xassxxdns.alitagotest.cf" or siteurl like "xassxxdns.alitagotest.cf" or domainname like "ximmd.sexytube0.com" or url like "ximmd.sexytube0.com" or siteurl like "ximmd.sexytube0.com" or domainname like "zerogravity1986.softether.net" or url like "zerogravity1986.softether.net" or siteurl like "zerogravity1986.softether.net" or domainname like "back.pl" or url like "back.pl" or siteurl like "back.pl" or domainname like "gf.phtml" or url like "gf.phtml" or siteurl like "gf.phtml"

Detection Query 4 :

dstipaddress IN ("1.34.140.5","2.58.242.74","5.188.34.134","5.188.230.69","8.219.119.5","14.1.98.160","14.128.33.8","14.1.98.223","27.154.215.126","27.154.105.36","27.149.115.78","27.149.79.35","31.232.221.35","36.112.10.102","36.112.188.119","36.112.186.135","36.112.206.121","36.249.156.117","36.249.156.122","36.249.156.159","36.249.156.178","36.249.156.205","36.249.156.206","36.249.156.220","36.249.156.226","36.112.200.35","36.249.156.51","36.112.198.68","36.249.156.69","36.112.10.99","39.72.220.221","42.73.98.232","45.123.189.19","45.32.140.182","45.32.232.146","45.63.123.142","45.63.116.190","45.131.69.197","45.76.169.12","45.77.195.169","45.32.61.246","45.77.231.209","45.76.37.168","45.63.59.121","45.77.11.47","45.32.84.223","45.63.62.217","45.63.48.36","45.76.43.37","45.76.66.19","45.76.243.67","45.63.17.9","45.77.28.77","45.76.194.89","45.76.37.85","45.63.95.62","45.63.94.71","45.77.86.70","49.93.136.14","49.93.184.194","59.120.144.153","59.124.120.178","59.120.167.25","59.125.128.54","59.120.58.176","60.250.199.112","60.250.146.19","60.251.155.19","60.248.152.204","59.120.82.67","60.184.242.224","60.251.205.37","60.220.43.193","60.251.58.145","60.248.1.64","60.251.201.8","60.248.88.151","60.248.110.97","60.249.239.86","61.220.112.137","60.220.84.41","61.247.165.27","60.220.84.63","61.220.35.15","61.221.55.4","61.222.245.73","61.219.118.99","61.216.74.97","64.176.38.35","65.20.97.251","66.42.103.188","66.42.42.109","66.42.40.189","66.42.36.236","66.42.60.242","66.42.77.138","77.111.226.5","78.141.221.241","78.141.238.97","84.17.57.40","89.187.163.216","95.179.189.106","95.179.235.135","95.179.186.251","98.159.37.4","103.107.198.117","103.16.231.220","103.16.231.254","103.233.253.197","103.25.254.210","103.149.200.44","103.179.45.203","103.73.160.232","103.77.211.193","103.106.230.88","103.172.80.35","104.238.149.146","104.238.182.153","104.238.152.209","103.51.145.98","103.73.162.99","104.156.231.98","106.53.181.231","106.122.171.92","108.61.181.104","108.61.177.81","110.42.10.148","110.85.170.125","111.203.153.245","110.74.172.80","111.55.138.141","111.55.137.40","111.203.153.95","112.5.168.102","112.5.168.104","112.5.145.154","112.5.143.161","112.5.168.138","112.5.168.151","112.5.168.160","112.54.132.162","112.5.168.187","112.5.168.218","112.5.168.231","112.5.168.234","112.5.168.238","112.51.26.151","112.66.108.16","112.5.168.29","112.51.44.102","112.51.44.142","112.51.44.143","112.51.44.188","112.51.44.189","112.51.44.20","112.51.44.206","112.51.44.217","112.51.44.234","112.5.168.65","112.51.44.37","112.80.50.138","112.51.44.57","112.5.168.93","113.76.136.171","114.246.237.111","114.255.70.18","114.255.70.20","114.255.70.30","114.246.93.103","114.246.94.102","114.35.122.83","114.246.94.154","114.246.92.58","114.246.92.71","117.133.51.176","117.61.244.135","117.56.214.246","117.132.198.70","117.92.127.132","117.130.201.90","118.163.217.199","118.163.197.241","118.163.31.226","118.163.104.67","118.163.142.80","118.163.3.76","119.116.159.217","119.13.79.145","120.233.10.212","120.36.251.100","120.36.248.104","120.42.128.165","120.36.250.103","120.36.254.100","120.36.248.109","120.36.253.106","120.36.255.105","120.36.251.110","120.36.251.11","120.36.249.114","120.36.251.114","120.36.254.112","120.36.249.121","120.36.249.122","120.36.254.119","120.36.254.120","120.36.249.127","120.36.251.130","120.36.255.127","120.36.252.13","120.36.250.133","120.36.250.134","120.36.250.135","120.36.254.131","120.36.254.135","120.36.251.141","120.36.250.142","120.41.125.225","120.36.253.148","120.36.250.152","120.36.252.151","120.36.253.152","120.36.254.151","120.36.255.153","120.36.252.157","120.37.162.246","120.36.252.166","120.36.249.172","120.36.253.169","120.36.252.175","120.36.254.175","120.36.251.179","120.36.253.178","120.36.252.18","120.36.252.181","120.36.248.185","120.36.253.180","120.36.255.179","120.36.253.186","120.36.253.187","120.36.250.19","120.36.251.19","120.36.251.190","120.36.255.189","120.41.244.15","120.36.254.192","120.36.249.197","120.36.248.200","120.36.253.195","120.36.251.2","120.36.251.20","120.36.255.196","120.36.251.202","120.36.254.202","120.36.250.207","120.36.250.210","120.36.249.213","120.36.251.213","120.36.253.212","120.36.251.215","120.36.252.215","120.36.255.214","120.36.250.221","120.36.255.22","120.36.251.230","120.36.255.228","120.36.253.23","120.36.253.231","120.36.251.234","120.36.248.237","120.36.253.232","120.36.253.233","120.36.249.238","120.36.251.237","120.36.255.233","120.36.255.237","120.36.249.245","120.36.252.242","120.36.255.24","120.36.249.248","120.36.250.247","120.36.253.247","120.36.253.248","120.36.251.25","120.36.251.254","120.36.249.28","120.36.251.3","120.36.251.30","120.36.254.3","120.36.254.32","120.36.249.33","120.36.250.4","120.36.250.43","120.36.249.47","120.36.248.48","120.36.250.48","120.36.249.52","120.36.250.53","120.36.249.54","120.36.251.54","120.36.249.55","120.36.251.56","120.36.248.57","120.36.250.58","120.36.250.6","120.36.253.6","120.36.254.63","120.36.250.65","120.36.251.65","120.36.250.67","120.36.252.69","120.36.248.73","120.36.255.74","120.36.250.76","120.41.222.74","120.36.248.80","120.36.251.80","120.36.251.84","120.36.252.90","120.36.249.91","120.36.251.91","120.36.252.91","120.36.254.92","120.36.254.94","120.36.248.97","120.36.251.97","120.36.249.98","120.36.252.98","121.207.60.123","122.116.33.118","122.232.149.231","122.201.241.230","122.116.159.52","122.116.102.93","123.121.157.240","123.51.237.194","123.252.121.7","123.252.122.7","123.12.90.227","123.60.61.104","124.126.158.130","124.126.139.199","124.127.17.171","124.127.220.223","124.150.135.3","123.51.223.96","124.64.22.13","124.126.141.74","124.127.78.22","124.127.72.52","125.227.147.106","125.227.140.168","125.227.1.220","125.227.196.157","125.227.219.145","125.228.239.13","125.227.218.2","124.64.23.80","125.229.172.48","125.227.136.60","137.220.34.137","137.220.39.222","137.220.43.47","137.220.36.87","138.199.62.148","139.180.137.219","139.180.217.19","139.180.158.51","139.84.174.129","140.82.27.163","140.82.50.151","141.164.41.128","140.82.48.6","141.164.55.227","141.164.56.93","144.202.26.205","144.34.171.162","144.202.33.164","144.202.62.109","144.202.91.107","144.202.94.216","144.202.98.41","147.139.133.246","149.28.132.137","149.28.132.161","149.28.201.146","149.28.188.184","149.248.34.100","149.28.149.29","149.28.252.19","149.248.38.179","149.248.39.202","149.248.44.191","149.248.51.22","149.28.72.106","155.138.155.170","155.138.136.190","155.138.151.225","155.138.133.56","156.146.45.152","156.146.45.194","158.247.197.28","159.138.152.61","162.14.178.86","167.172.33.16","167.179.87.215","167.179.97.121","171.120.88.137","178.62.208.162","180.122.149.177","182.34.19.234","183.240.139.216","183.253.28.104","183.253.29.110","183.253.28.121","183.250.213.20","183.253.29.189","183.250.213.55","183.253.29.66","183.253.28.67","183.250.213.80","183.250.213.83","183.166.90.97","185.216.118.71","185.135.73.192","185.213.82.239","185.213.82.243","185.213.82.55","185.213.82.65","190.92.241.15","191.232.188.144","193.42.24.68","193.42.25.73","198.13.38.211","202.182.109.151","202.101.145.22","202.182.106.31","202.39.151.239","202.99.19.250","202.99.19.254","203.74.126.20","203.69.36.122","207.246.118.144","207.246.117.149","207.246.114.173","207.148.68.131","207.148.122.69","207.148.67.146","207.246.108.64","207.246.127.64","207.148.73.238","207.148.92.220","207.148.4.96","208.72.154.55","210.242.152.155","210.242.38.241","210.243.225.41","210.66.220.39","210.242.76.32","210.71.166.50","211.20.144.116","211.20.104.187","211.21.19.11","211.22.143.228","211.20.115.60","211.20.154.60","211.20.100.78","211.20.100.79","211.99.103.102","211.21.61.46","211.75.185.37","211.99.103.243","212.107.28.16","212.107.28.22","212.107.28.23","211.78.84.17","211.20.91.77","211.99.100.90","211.99.100.91","211.99.98.197","216.128.149.106","216.128.128.238","218.26.159.254","218.5.173.137","218.5.157.171","218.66.163.188","219.143.179.250","220.128.108.164","220.130.153.127","220.130.176.23","220.128.125.3","220.130.254.251","219.92.229.53","220.162.9.150","220.250.44.62","221.218.143.112","221.218.136.12","221.218.138.123","221.218.143.122","221.218.143.184","221.218.136.192","221.216.116.238","221.218.137.229","221.218.139.248","221.216.208.188","221.218.142.26","221.218.141.96","222.92.153.125","223.104.40.128","223.104.41.13","223.104.40.142","223.104.40.204","223.27.34.132","223.104.55.183","223.104.39.82") or srcipaddress IN ("1.34.140.5","2.58.242.74","5.188.34.134","5.188.230.69","8.219.119.5","14.1.98.160","14.128.33.8","14.1.98.223","27.154.215.126","27.154.105.36","27.149.115.78","27.149.79.35","31.232.221.35","36.112.10.102","36.112.188.119","36.112.186.135","36.112.206.121","36.249.156.117","36.249.156.122","36.249.156.159","36.249.156.178","36.249.156.205","36.249.156.206","36.249.156.220","36.249.156.226","36.112.200.35","36.249.156.51","36.112.198.68","36.249.156.69","36.112.10.99","39.72.220.221","42.73.98.232","45.123.189.19","45.32.140.182","45.32.232.146","45.63.123.142","45.63.116.190","45.131.69.197","45.76.169.12","45.77.195.169","45.32.61.246","45.77.231.209","45.76.37.168","45.63.59.121","45.77.11.47","45.32.84.223","45.63.62.217","45.63.48.36","45.76.43.37","45.76.66.19","45.76.243.67","45.63.17.9","45.77.28.77","45.76.194.89","45.76.37.85","45.63.95.62","45.63.94.71","45.77.86.70","49.93.136.14","49.93.184.194","59.120.144.153","59.124.120.178","59.120.167.25","59.125.128.54","59.120.58.176","60.250.199.112","60.250.146.19","60.251.155.19","60.248.152.204","59.120.82.67","60.184.242.224","60.251.205.37","60.220.43.193","60.251.58.145","60.248.1.64","60.251.201.8","60.248.88.151","60.248.110.97","60.249.239.86","61.220.112.137","60.220.84.41","61.247.165.27","60.220.84.63","61.220.35.15","61.221.55.4","61.222.245.73","61.219.118.99","61.216.74.97","64.176.38.35","65.20.97.251","66.42.103.188","66.42.42.109","66.42.40.189","66.42.36.236","66.42.60.242","66.42.77.138","77.111.226.5","78.141.221.241","78.141.238.97","84.17.57.40","89.187.163.216","95.179.189.106","95.179.235.135","95.179.186.251","98.159.37.4","103.107.198.117","103.16.231.220","103.16.231.254","103.233.253.197","103.25.254.210","103.149.200.44","103.179.45.203","103.73.160.232","103.77.211.193","103.106.230.88","103.172.80.35","104.238.149.146","104.238.182.153","104.238.152.209","103.51.145.98","103.73.162.99","104.156.231.98","106.53.181.231","106.122.171.92","108.61.181.104","108.61.177.81","110.42.10.148","110.85.170.125","111.203.153.245","110.74.172.80","111.55.138.141","111.55.137.40","111.203.153.95","112.5.168.102","112.5.168.104","112.5.145.154","112.5.143.161","112.5.168.138","112.5.168.151","112.5.168.160","112.54.132.162","112.5.168.187","112.5.168.218","112.5.168.231","112.5.168.234","112.5.168.238","112.51.26.151","112.66.108.16","112.5.168.29","112.51.44.102","112.51.44.142","112.51.44.143","112.51.44.188","112.51.44.189","112.51.44.20","112.51.44.206","112.51.44.217","112.51.44.234","112.5.168.65","112.51.44.37","112.80.50.138","112.51.44.57","112.5.168.93","113.76.136.171","114.246.237.111","114.255.70.18","114.255.70.20","114.255.70.30","114.246.93.103","114.246.94.102","114.35.122.83","114.246.94.154","114.246.92.58","114.246.92.71","117.133.51.176","117.61.244.135","117.56.214.246","117.132.198.70","117.92.127.132","117.130.201.90","118.163.217.199","118.163.197.241","118.163.31.226","118.163.104.67","118.163.142.80","118.163.3.76","119.116.159.217","119.13.79.145","120.233.10.212","120.36.251.100","120.36.248.104","120.42.128.165","120.36.250.103","120.36.254.100","120.36.248.109","120.36.253.106","120.36.255.105","120.36.251.110","120.36.251.11","120.36.249.114","120.36.251.114","120.36.254.112","120.36.249.121","120.36.249.122","120.36.254.119","120.36.254.120","120.36.249.127","120.36.251.130","120.36.255.127","120.36.252.13","120.36.250.133","120.36.250.134","120.36.250.135","120.36.254.131","120.36.254.135","120.36.251.141","120.36.250.142","120.41.125.225","120.36.253.148","120.36.250.152","120.36.252.151","120.36.253.152","120.36.254.151","120.36.255.153","120.36.252.157","120.37.162.246","120.36.252.166","120.36.249.172","120.36.253.169","120.36.252.175","120.36.254.175","120.36.251.179","120.36.253.178","120.36.252.18","120.36.252.181","120.36.248.185","120.36.253.180","120.36.255.179","120.36.253.186","120.36.253.187","120.36.250.19","120.36.251.19","120.36.251.190","120.36.255.189","120.41.244.15","120.36.254.192","120.36.249.197","120.36.248.200","120.36.253.195","120.36.251.2","120.36.251.20","120.36.255.196","120.36.251.202","120.36.254.202","120.36.250.207","120.36.250.210","120.36.249.213","120.36.251.213","120.36.253.212","120.36.251.215","120.36.252.215","120.36.255.214","120.36.250.221","120.36.255.22","120.36.251.230","120.36.255.228","120.36.253.23","120.36.253.231","120.36.251.234","120.36.248.237","120.36.253.232","120.36.253.233","120.36.249.238","120.36.251.237","120.36.255.233","120.36.255.237","120.36.249.245","120.36.252.242","120.36.255.24","120.36.249.248","120.36.250.247","120.36.253.247","120.36.253.248","120.36.251.25","120.36.251.254","120.36.249.28","120.36.251.3","120.36.251.30","120.36.254.3","120.36.254.32","120.36.249.33","120.36.250.4","120.36.250.43","120.36.249.47","120.36.248.48","120.36.250.48","120.36.249.52","120.36.250.53","120.36.249.54","120.36.251.54","120.36.249.55","120.36.251.56","120.36.248.57","120.36.250.58","120.36.250.6","120.36.253.6","120.36.254.63","120.36.250.65","120.36.251.65","120.36.250.67","120.36.252.69","120.36.248.73","120.36.255.74","120.36.250.76","120.41.222.74","120.36.248.80","120.36.251.80","120.36.251.84","120.36.252.90","120.36.249.91","120.36.251.91","120.36.252.91","120.36.254.92","120.36.254.94","120.36.248.97","120.36.251.97","120.36.249.98","120.36.252.98","121.207.60.123","122.116.33.118","122.232.149.231","122.201.241.230","122.116.159.52","122.116.102.93","123.121.157.240","123.51.237.194","123.252.121.7","123.252.122.7","123.12.90.227","123.60.61.104","124.126.158.130","124.126.139.199","124.127.17.171","124.127.220.223","124.150.135.3","123.51.223.96","124.64.22.13","124.126.141.74","124.127.78.22","124.127.72.52","125.227.147.106","125.227.140.168","125.227.1.220","125.227.196.157","125.227.219.145","125.228.239.13","125.227.218.2","124.64.23.80","125.229.172.48","125.227.136.60","137.220.34.137","137.220.39.222","137.220.43.47","137.220.36.87","138.199.62.148","139.180.137.219","139.180.217.19","139.180.158.51","139.84.174.129","140.82.27.163","140.82.50.151","141.164.41.128","140.82.48.6","141.164.55.227","141.164.56.93","144.202.26.205","144.34.171.162","144.202.33.164","144.202.62.109","144.202.91.107","144.202.94.216","144.202.98.41","147.139.133.246","149.28.132.137","149.28.132.161","149.28.201.146","149.28.188.184","149.248.34.100","149.28.149.29","149.28.252.19","149.248.38.179","149.248.39.202","149.248.44.191","149.248.51.22","149.28.72.106","155.138.155.170","155.138.136.190","155.138.151.225","155.138.133.56","156.146.45.152","156.146.45.194","158.247.197.28","159.138.152.61","162.14.178.86","167.172.33.16","167.179.87.215","167.179.97.121","171.120.88.137","178.62.208.162","180.122.149.177","182.34.19.234","183.240.139.216","183.253.28.104","183.253.29.110","183.253.28.121","183.250.213.20","183.253.29.189","183.250.213.55","183.253.29.66","183.253.28.67","183.250.213.80","183.250.213.83","183.166.90.97","185.216.118.71","185.135.73.192","185.213.82.239","185.213.82.243","185.213.82.55","185.213.82.65","190.92.241.15","191.232.188.144","193.42.24.68","193.42.25.73","198.13.38.211","202.182.109.151","202.101.145.22","202.182.106.31","202.39.151.239","202.99.19.250","202.99.19.254","203.74.126.20","203.69.36.122","207.246.118.144","207.246.117.149","207.246.114.173","207.148.68.131","207.148.122.69","207.148.67.146","207.246.108.64","207.246.127.64","207.148.73.238","207.148.92.220","207.148.4.96","208.72.154.55","210.242.152.155","210.242.38.241","210.243.225.41","210.66.220.39","210.242.76.32","210.71.166.50","211.20.144.116","211.20.104.187","211.21.19.11","211.22.143.228","211.20.115.60","211.20.154.60","211.20.100.78","211.20.100.79","211.99.103.102","211.21.61.46","211.75.185.37","211.99.103.243","212.107.28.16","212.107.28.22","212.107.28.23","211.78.84.17","211.20.91.77","211.99.100.90","211.99.100.91","211.99.98.197","216.128.149.106","216.128.128.238","218.26.159.254","218.5.173.137","218.5.157.171","218.66.163.188","219.143.179.250","220.128.108.164","220.130.153.127","220.130.176.23","220.128.125.3","220.130.254.251","219.92.229.53","220.162.9.150","220.250.44.62","221.218.143.112","221.218.136.12","221.218.138.123","221.218.143.122","221.218.143.184","221.218.136.192","221.216.116.238","221.218.137.229","221.218.139.248","221.216.208.188","221.218.142.26","221.218.141.96","222.92.153.125","223.104.40.128","223.104.41.13","223.104.40.142","223.104.40.204","223.27.34.132","223.104.55.183","223.104.39.82")

Detection Query 5 :

md5hash IN ("48ca18a25424a0f52276290b619a7a83","38f5ff8169423e2c756848c02e8cac3b","d61326c4e6d24aa9b67e2b7a3ef7cedf","f8de2e99dc7523d2c83d1a48e844c5ff","5b5a2c7fa705d8b1eb04da5db900b0d7","655cd134976d3e80c521708aa8be418b","dae8f50ea44225fae3ba1f160b42bfdc","fdece34bc084f1e252aeae274650eb8d","596b990b0b389d906a8f4384837c1878","a73eca669fe80628dbbd2c7d9bb14c8f","be121e707f817aa9392c55af1e7ec2aa","7ce68f0dd85355ba2897a68521167e56","f82694de2f19e1bff333c27bb7eb7a56","1933c314041415939331fce183939547","8829f6f1cc5fc0aab2f6e71bfd7dc53d","cf903e4a1629aa0582fd0363b5786676","f01a9a2d1e31332ed36c1a4d2839f412","ef713447f18f5b7ee16af4ac37ec4133","8dcc4f9ccc6b6adf7eeeb3f51c95afad","b04375cca637f0702bf27feaff22a92d","bcacc7ca999980d26c186ef791242fb5","1b8e29b6b7972fb124425aaa257f8f6d","4f61b9ab907f351bb40b37b10f4974d0","6d57c42dee8bd7789969e2dd28671162","776807750280daad05348f931a33e4ef","a973c0ab904c1b74655a906b99b76850","f62cbbbdf35c7790909c26c7c5fbce05","a05cdf6afcbb107961307f59cbab5e4f","7d5a182f70bed0e4fa2f8615aba070de","1bcaef76b2063f1b80b0fa0d277ec9c5","4d33bfb75e27fefaa72526899604d557","fc6e8ca41cf4f6100177352660e520b4")

Detection Query 6 :

sha256hash IN ("72c6af6a4be99e31c4a7a0aa4f01750792788e7f6f9749243a9f2c47c14a708f","456586ababa08f70216c4459f4d6375676166ebfddd98a33b447ceb5099e8dc5","2f5c406eb64ad8902c8e30610d43fd3efc05a14cdb8fb158818953eaf3dc6a81","5782ff2c835c88cc1ee521d2e8c523cfad73db3f9a29c93b40c4223f0338ade9","0e6fecb2d369b0eae63731616a3daada52036634885ab1b85b115af6bc5bcb86","36f3b7645609ef40444dbc68f01d26c543d67689eda4937272ea5cfa4df1b522","670fa10a2ddde21fd594c4fef86b554d864089ed2de7153b472e921c623403ae","645f6f2667af01a94d04a9d7a71916a13d9426835d636b4ceee2e25ccb34e525","4d488f21269b18e37aaca93ac2a61707c9b611e506cdb3b287277746e94636b5","a14844e982f172d0f23910558c3f390a9d4c45dc32db825c2af7cf0ed8631db2","add7dd142e4f7e2873bc8f7b7fb6308063608e0b49a773dea93abad4047f1489","e7e727458f573dded05537baddac2867d2801db1c3c74410398d063dfd6f6575","8e1b56ef51ba70aa4c4cfd4430820f20875b354588d5d723ba4d3940ea6c924b","46e59172c40c95d83c3a6f24f801fc2265653c8b575b66a726463e2a4eebd7f2","752b14c6e6936991d51fcd5ebf40d303e657c2372893604f96044848ad9a5f24","7b9efc7ef8957411cdd22582ce4bfb3a5f76d9c91cdb7e36bf85c9785a2480e9","c9d5dc956841e000bfd8762e2f0b48b66c79b79500e894b4efa7fb9ba17e4e9e","2fbcb1995c458e5affd5fb8f1f979a08ddce21714a2e413aa3d5dc44f9f245fe","33790218d5871af646feef5be29e0596d4703a45ce675c1eb2ca00140b3a1bde","c7f86a4623db5c90273cea041d43207849c5c6b0060c370b2095f13871b1366d","2ecb51d7fa3bc3fa7ad7df64c6d0cd1f4ff2b37ed6839d3cff529fb08af49fb0","efb0437e6a6a0f07169952f1a8b734299ec9a8b1faadbed811fe017f2cf54976","8b869a5edaff74ff18bca3658a519a19771e66d00ff7849af7a142dd6fc8da85","804a53be802378a8ec4c94602fd3d6584e0d472d83148e8a42c731950fec415d","c4503db6ece93eddf4511e787607cb14606a1df9f526f1e39992497119437cec","b1552703ff0035f197c22cdb3a514bb6aa45ec98de3ef5409faab0978f18c35e","8a592e22c51311d482272ec5aba0103c9cd0cfd78e5b5ba75dfa8f1c56926672","86f1cfa6a2e0a8cb6fc1fbee28472308e6467932f8658a6a4885e29ed8c34a67","e93244080a749b521f63476343ce3c81cc8c1b672fa0d9e67359aee37544c784","9dc85f9569a15eaf51c7d34254767ea30dd67b2178cec4cc7125288b9544fe00","644decbc6ce8c52382f4755fa6fc2cb4d89a0e7ec0e574c11b398a6f2eed04b1","67db57a1f957031b78f29aa91e2e87780eae3835290259eff846d8f14afb794b")